136.112.73.222

{
    "protocol_emulated": true,
    "emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
    "emulator_response_len": 34,
    "bytes_in": 247,
    "payload_entropy": 5.440779853395353,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "redis",
    "app_proto": "redis",
    "asn": 396982,
    "country": "US",
    "dst_port": 6379,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 56,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "abb0dc326444db204ea3647cb27338ae575e7dfe",
    "event_fingerprint": "ad893b67498ef5007c1d8733f7eb11e5e6fc39df",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "redis",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa1d9f272beb9dd27db6a6041a89a828",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6379,
        "service": "redis",
        "service_name": "redis",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, like Gecko, Safari\/528.16) OmniWeb\/v622.8.0.112941\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, like Gecko, Safari\/528.16) OmniWeb\/v622.8.0.112941\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4880ecc53bcee43958ea5646d288ec13759adc86",
    "protocol_details": {
        "redis_command_fr": "Sonde protocole Redis",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "port": 6379,
        "service": "redis",
        "service_label_fr": "REDIS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
    "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
    "target_port_label": "6379 \u00b7 REDIS",
    "emulator_service": "redis",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "redis",
        "service_label_fr": "REDIS",
        "dst_port": 6379,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Redis 7.0",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "redis_command_fr": "Sonde protocole Redis",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
            "port": 6379,
            "service": "redis",
            "service_label_fr": "REDIS"
        },
        "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "target_port_label": "6379 \u00b7 REDIS",
        "emulator_service": "redis",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "redis",
        "service_banner": "Redis 7.0",
        "service_os": "linux",
        "dst_port": "6379"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 8.58,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_port_scan_fast",
        "redis_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 241,
    "payload_entropy": 5.417062480399715,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "postgres",
    "app_proto": "postgres",
    "asn": 396982,
    "country": "US",
    "dst_port": 5432,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 53,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b73b68b93b206eaaf5f9320b6dce74fca51c9a0c",
    "event_fingerprint": "5302d14dbea4b63204d1ed61b172d5e31032aca7",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "postgres",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9d548f960211b07e0d0c508237865a66",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5432,
        "service": "postgres",
        "service_name": "postgres",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "24f5b636c52403522b47c0f01de8fbfb1641b6ee",
    "protocol_details": {
        "postgres_startup_fr": "Handshake PostgreSQL (startup)",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
        "port": 5432,
        "service": "postgres",
        "service_label_fr": "POSTGRES"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
    "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
    "target_port_label": "5432 \u00b7 POSTGRES",
    "emulator_service": "postgres",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via POSTGRES \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "postgres",
        "service_label_fr": "POSTGRES",
        "dst_port": 5432,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "PostgreSQL 15.4",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "postgres_startup_fr": "Handshake PostgreSQL (startup)",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
            "port": 5432,
            "service": "postgres",
            "service_label_fr": "POSTGRES"
        },
        "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5432\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, li",
        "target_port_label": "5432 \u00b7 POSTGRES",
        "emulator_service": "postgres",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "postgres",
        "service_banner": "PostgreSQL 15.4",
        "service_os": "linux",
        "dst_port": "5432"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 8.11,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_port_scan_fast",
        "postgres_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
    "emulator_response_len": 45,
    "bytes_in": 263,
    "payload_entropy": 5.398785358508159,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "remoteanything",
    "app_proto": "remoteanything",
    "asn": 396982,
    "country": "US",
    "dst_port": 4000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 51,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "87cef3469fdafdb778904e2462babe577bfc4016",
    "event_fingerprint": "7efabdbca5bf0f016f426b45f2c65d538f330e51",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 51,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "remoteanything",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7ad7b36c62a8b6c412e3f58e43b98469",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 4000,
        "service": "remoteanything",
        "service_name": "remoteanything",
        "risk_score": 51
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari\/525.20.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari\/525.20.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4e5d7debe195680a573f16e91f2be59a3629faa9",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
        "port": 4000,
        "service": "remoteanything",
        "service_label_fr": "REMOTEANYTHING"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
    "attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)",
    "target_port_label": "4000 \u00b7 REMOTEANYTHING",
    "emulator_service": "remoteanything",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REMOTEANYTHING \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 51,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 51,
        "risk_label": "Moyen",
        "service_name": "remoteanything",
        "service_label_fr": "REMOTEANYTHING",
        "dst_port": 4000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-remoteanything",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
            "port": 4000,
            "service": "remoteanything",
            "service_label_fr": "REMOTEANYTHING"
        },
        "attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nUser-Agent: HTC_Dream Mozilla\/5.0 (Linux; U; Android 1.5; en-ca; Build\/CUPCAKE) AppleWebK",
        "target_port_label": "4000 \u00b7 REMOTEANYTHING",
        "emulator_service": "remoteanything",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "remoteanything",
        "service_banner": "honeypot-remoteanything",
        "service_os": "linux",
        "dst_port": "4000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 15.68,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8493850600595145,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "cassandra-jmx",
    "app_proto": "cassandra-jmx",
    "asn": 396982,
    "country": "US",
    "dst_port": 7000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c8ad6b45d839a2759c6f49853bbf6be33290d70b",
    "event_fingerprint": "4757e40bf5bfa6ed554ee42d6be3813893ceaf98",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-jmx",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d853bc858b27aa883abacb0d8ff0a283",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7000,
        "service": "cassandra-jmx",
        "service_name": "cassandra-jmx",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\u0003\ufffd\ufffd\u001a\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\u001a\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\u0003\ufffd\ufffd\u001a\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\u001a\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u07d1\ufffd05\ufffd\ufffd\ufffdB\ufffd}\ufffdN\ufffd$\ufffdG\ufffd\ufffd\u0007c\ufffd\r\ufffd\ufffd\ufffd\ufffdUM\u0017\u000e",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\u0003\ufffd\ufffd\u001a\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\u001a\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "95db1326d38bf2280f2f720736e8c40151579d21",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\u0003\ufffd\ufffd\u001a\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\u001a\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 7000,
        "service": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\ufffd\ufffd\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)",
    "target_port_label": "7000 \u00b7 CASSANDRA JMX",
    "emulator_service": "cassandra-jmx",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA JMX \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX",
        "dst_port": 7000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-jmx",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\u0003\ufffd\ufffd\u001a\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\u001a\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 7000,
            "service": "cassandra-jmx",
            "service_label_fr": "CASSANDRA JMX"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffdK>\ufffdg5\ufffd\u03c4\ufffdRy\ufffd\ufffd\ufffd<\ufffd{7\ufffd\ufffd\ufffd2h\ufffd\ufffd\ufffd\ufffdp\ufffd \ufffd\"\ufffdR\ufffdc!g\ufffd\ufffd\ufffd\ufffdWmX\ufffd\ufffd%\ufffd\u063d\ufffdqh\ufffd*\ufffd<\ufffd0\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "7000 \u00b7 CASSANDRA JMX",
        "emulator_service": "cassandra-jmx",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_jmx",
        "service_banner": "honeypot-cassandra-jmx",
        "service_os": "linux",
        "dst_port": "7000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 15.43,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206e656f346a5f6874747020726561647920706f72743d373437340d0a",
    "emulator_response_len": 41,
    "bytes_in": 239,
    "payload_entropy": 5.811693151074598,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "neo4j-http",
    "app_proto": "neo4j-http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7474,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "8b413973e06024d8ce0a842f113efc69dd4c4aac",
    "event_fingerprint": "728f2bebdda42ad97156188cffe1e575f6806d65",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "neo4j-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "85ea16802f038c3b793bde0fe323ee79",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7474,
        "service": "neo4j-http",
        "service_name": "neo4j-http",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd?\ufffd\u02cbxN\u0002\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\u0007\" &\ufffd\ufffd\u0019\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\u0013\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0005\u0005\u0615\u0261F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd?\ufffd\u02cbxN\u0002\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\u0007\" &\ufffd\ufffd\u0019\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\u0013\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0005\u0005\u0615\u0261F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd.\ufffdjH\u0014>\u0004\ufffd\ufffd\ufffd\u033e\ufffd\u0014\r\ufffd_SK\u001a\ufffdA\ufffd1\ufffd>\ufffd:",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd?\ufffd\u02cbxN\u0002\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\u0007\" &\ufffd\ufffd\u0019\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\u0013\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0005\u0005\u0615\u0261F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7659f52d7912fbe826a5a71e6be10a7028ee6552",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd?\ufffd\u02cbxN\u0002\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\u0007\" &\ufffd\ufffd\u0019\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\u0013\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0005\u0005\u0615\u0261F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 7474,
        "service": "neo4j-http",
        "service_label_fr": "NEO4J HTTP"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd?\ufffd\u02cbxN\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\" &\ufffd\ufffd\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0615\u0261F&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via NEO4J HTTP:7474 \u00b7 (reconnaissance)",
    "target_port_label": "7474 \u00b7 NEO4J HTTP",
    "emulator_service": "neo4j-http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NEO4J HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "neo4j-http",
        "service_label_fr": "NEO4J HTTP",
        "dst_port": 7474,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-neo4j-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd?\ufffd\u02cbxN\u0002\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\u0007\" &\ufffd\ufffd\u0019\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\u0013\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0005\u0005\u0615\u0261F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 7474,
            "service": "neo4j-http",
            "service_label_fr": "NEO4J HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NEO4J HTTP:7474 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd?\ufffd\u02cbxN\ufffd\ufffdH\u04fa\ufffd\ufffd)wr\ufffd\ufffd#\ufffdW\ufffd\ufffd\ufffdHs\ufffd\" &\ufffd\ufffd\ufffd5\ufffd\ufffdI\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdGqU\u0615\u0261F&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "7474 \u00b7 NEO4J HTTP",
        "emulator_service": "neo4j-http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "neo4j_http",
        "service_banner": "honeypot-neo4j-http",
        "service_os": "linux",
        "dst_port": "7474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 15.25,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "neo4j_http_emulated",
        "neo4j_http_payload",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 247,
    "payload_entropy": 5.430939774440519,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 396982,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "13543258c8dbd6ceb53f4c03b584679378f59da4",
    "event_fingerprint": "c6397497acebeb3231ed85d5db13c626b10bb1b4",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "faf38338882248674a3f5a306aca89fd",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3879.0 Safari\/537.36 Edg\/78.0.249.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3879.0 Safari\/537.36 Edg\/78.0.249.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71a98c58cb5ae1119cb725d8f2735a3f3a8804c7",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
    "attack_vector": "port scan syn \u00b7 via AWS ECS AGENT:4567 \u00b7 (reconnaissance)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AWS ECS AGENT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "port scan syn \u00b7 via AWS ECS AGENT:4567 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4567\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 15.18,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a",
    "emulator_response_len": 42,
    "bytes_in": 239,
    "payload_entropy": 5.881797282882818,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "game-unreal",
    "app_proto": "game-unreal",
    "asn": 396982,
    "country": "US",
    "dst_port": 7777,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e5108bd47cf6137506f2f98845eb58fc519bee1c",
    "event_fingerprint": "0f97dacc0fa4c232914a20911ea8b2a3852db60e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "game-unreal",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "038cda45430b2949d0e176c418941db5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7777,
        "service": "game-unreal",
        "service_name": "game-unreal",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001f[~\ufffd\ufffdkU\u0717\ufffd\f\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffd\u000fo\ufffd\ufffd\u0013\u001e\ufffd6\ufffd\ufffd \ufffdk\ufffdNvE\u0019W-Y\ufffd\ufffd\ufffd{\u0011\ufffd\ufffd\"\ufffdV\u001e\u06baxx_\ufffdTSD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001f[~\ufffd\ufffdkU\u0717\ufffd\f\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffd\u000fo\ufffd\ufffd\u0013\u001e\ufffd6\ufffd\ufffd \ufffdk\ufffdNvE\u0019W-Y\ufffd\ufffd\ufffd{\u0011\ufffd\ufffd\"\ufffdV\u001e\u06baxx_\ufffdTSD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \"\ufffdq\ufffd\u0012\ufffd\u0016H\ufffd\ufffd 1\ufffd\u0002\ufffd\u0661z\ufffd\ufffd\ufffd\ufffdW\u0014j\u0302\ufffdy\ufffd\ufffdu",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001f[~\ufffd\ufffdkU\u0717\ufffd\f\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffd\u000fo\ufffd\ufffd\u0013\u001e\ufffd6\ufffd\ufffd \ufffdk\ufffdNvE\u0019W-Y\ufffd\ufffd\ufffd{\u0011\ufffd\ufffd\"\ufffdV\u001e\u06baxx_\ufffdTSD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9e13a94aa99bf0869770af9d1fd94d37977bc137",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001f[~\ufffd\ufffdkU\u0717\ufffd\f\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffd\u000fo\ufffd\ufffd\u0013\u001e\ufffd6\ufffd\ufffd \ufffdk\ufffdNvE\u0019W-Y\ufffd\ufffd\ufffd{\u0011\ufffd\ufffd\"\ufffdV\u001e\u06baxx_\ufffdTSD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 7777,
        "service": "game-unreal",
        "service_label_fr": "GAME UNREAL"
    },
    "evidence_snippet": "\ufffd\ufffd[~\ufffd\ufffdkU\u0717\ufffd\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd6\ufffd\ufffd \ufffdk\ufffdNvEW-Y\ufffd\ufffd\ufffd{\ufffd\ufffd\"\ufffdV\u06baxx_\ufffdTSD\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via GAME UNREAL:7777 \u00b7 (reconnaissance)",
    "target_port_label": "7777 \u00b7 GAME UNREAL",
    "emulator_service": "game-unreal",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via GAME UNREAL \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "game-unreal",
        "service_label_fr": "GAME UNREAL",
        "dst_port": 7777,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-game-unreal",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001f[~\ufffd\ufffdkU\u0717\ufffd\f\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffd\u000fo\ufffd\ufffd\u0013\u001e\ufffd6\ufffd\ufffd \ufffdk\ufffdNvE\u0019W-Y\ufffd\ufffd\ufffd{\u0011\ufffd\ufffd\"\ufffdV\u001e\u06baxx_\ufffdTSD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 7777,
            "service": "game-unreal",
            "service_label_fr": "GAME UNREAL"
        },
        "attack_vector": "port scan syn \u00b7 via GAME UNREAL:7777 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd[~\ufffd\ufffdkU\u0717\ufffd\ufffdM\ufffd;\ufffd)[\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd6\ufffd\ufffd \ufffdk\ufffdNvEW-Y\ufffd\ufffd\ufffd{\ufffd\ufffd\"\ufffdV\u06baxx_\ufffdTSD\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "7777 \u00b7 GAME UNREAL",
        "emulator_service": "game-unreal",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "game_unreal",
        "service_banner": "honeypot-game-unreal",
        "service_os": "linux",
        "dst_port": "7777"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.59,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
    "emulator_response_len": 39,
    "bytes_in": 229,
    "payload_entropy": 5.415684138084388,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "upnp-tcp",
    "app_proto": "upnp-tcp",
    "asn": 396982,
    "country": "US",
    "dst_port": 5001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "048610e48a2af7d38fc411cc22060baa574c0046",
    "event_fingerprint": "9e6806c5d201b773553fc6b2fc3ab265cff40d6c",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "upnp-tcp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b768f341f9c8713f25ba37128883c3d4",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5001,
        "service": "upnp-tcp",
        "service_name": "upnp-tcp",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.94 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.94 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86720b04a066cc2915de2c4a8c27d6c9efbf94d3",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "port": 5001,
        "service": "upnp-tcp",
        "service_label_fr": "UPNP TCP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
    "target_port_label": "5001 \u00b7 UPNP TCP",
    "emulator_service": "upnp-tcp",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "upnp-tcp",
        "service_label_fr": "UPNP TCP",
        "dst_port": 5001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-upnp-tcp",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
            "port": 5001,
            "service": "upnp-tcp",
            "service_label_fr": "UPNP TCP"
        },
        "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "target_port_label": "5001 \u00b7 UPNP TCP",
        "emulator_service": "upnp-tcp",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "upnp_tcp",
        "service_banner": "honeypot-upnp-tcp",
        "service_os": "linux",
        "dst_port": "5001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.45,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 237,
    "payload_entropy": 5.357083708172797,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "rtsp",
    "app_proto": "rtsp",
    "asn": 396982,
    "country": "US",
    "dst_port": 554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "583b27d927b4c561b2b5830b6afe1368f107029b",
    "event_fingerprint": "4ac572b30c42b1fa931e2b5faef77bf7f3e866ec",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "rtsp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e2924336dc9be00f8093527a775ded75",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 554,
        "service": "rtsp",
        "service_name": "rtsp",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML like Gecko) Version\/6.0.2 Safari\/536.26.17\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML like Gecko) Version\/6.0.2 Safari\/536.26.17\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ffa9d807a521535c555714f0d2c91c8c79415d4a",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
        "port": 554,
        "service": "rtsp",
        "service_label_fr": "RTSP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
    "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
    "target_port_label": "554 \u00b7 RTSP",
    "emulator_service": "rtsp",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "rtsp",
        "service_label_fr": "RTSP",
        "dst_port": 554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
            "port": 554,
            "service": "rtsp",
            "service_label_fr": "RTSP"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit\/536.26.17 (KHTML li",
        "target_port_label": "554 \u00b7 RTSP",
        "emulator_service": "rtsp",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp",
        "service_banner": "honeypot-rtsp",
        "service_os": "linux",
        "dst_port": "554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.33,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420636f7563686261736520726561647920706f72743d383039310d0a",
    "emulator_response_len": 40,
    "bytes_in": 239,
    "payload_entropy": 5.802206094718333,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "couchbase",
    "app_proto": "couchbase",
    "asn": 396982,
    "country": "US",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b311cc7f989fb93ad181b7f43a4a458c57e0fcac",
    "event_fingerprint": "3b60071144288aefe5f7d3a92b0e4863e95fe8f5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "couchbase",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d76a4ed0381eebc84121ec15ebf99f5b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8091,
        "service": "couchbase",
        "service_name": "couchbase",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\u001d\ufffd\ufffd{\ufffd\u000b!\ufffd|?m\n \ufffdU\u0004\u0002\ufffd\u001c\"+\ufffd\ufffd\ufffd\u0010\r\ufffd<\ufffdYsy\u00836*,\ufffd01\u0011\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\u001d\ufffd\ufffd{\ufffd\u000b!\ufffd|?m\n \ufffdU\u0004\u0002\ufffd\u001c\"+\ufffd\ufffd\ufffd\u0010\r\ufffd<\ufffdYsy\u00836*,\ufffd01\u0011\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdW\u030f\ufffdO[\ufffd>A<\ufffdN\ufffdZ\/E\ufffd\ufffd]\ufffd\u01da]\u001f\u0002J\ufffd\u0004{#",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\u001d\ufffd\ufffd{\ufffd\u000b!\ufffd|?m\n \ufffdU\u0004\u0002\ufffd\u001c\"+\ufffd\ufffd\ufffd\u0010\r\ufffd<\ufffdYsy\u00836*,\ufffd01\u0011\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "def642cf36d6aace930262abbec1bbcdd7da1151",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\u001d\ufffd\ufffd{\ufffd\u000b!\ufffd|?m\n \ufffdU\u0004\u0002\ufffd\u001c\"+\ufffd\ufffd\ufffd\u0010\r\ufffd<\ufffdYsy\u00836*,\ufffd01\u0011\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8091,
        "service": "couchbase",
        "service_label_fr": "COUCHBASE"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd!\ufffd|?m\n \ufffdU\ufffd\"+\ufffd\ufffd\ufffd\r\ufffd<\ufffdYsy\u00836*,\ufffd01\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
    "target_port_label": "8091 \u00b7 COUCHBASE",
    "emulator_service": "couchbase",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COUCHBASE \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "couchbase",
        "service_label_fr": "COUCHBASE",
        "dst_port": 8091,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchbase",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\u001d\ufffd\ufffd{\ufffd\u000b!\ufffd|?m\n \ufffdU\u0004\u0002\ufffd\u001c\"+\ufffd\ufffd\ufffd\u0010\r\ufffd<\ufffdYsy\u00836*,\ufffd01\u0011\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8091,
            "service": "couchbase",
            "service_label_fr": "COUCHBASE"
        },
        "attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd!K\ufffd\u00ba\ufffd3\ufffd\n\ufffdn(\tIk\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd!\ufffd|?m\n \ufffdU\ufffd\"+\ufffd\ufffd\ufffd\r\ufffd<\ufffdYsy\u00836*,\ufffd01\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8091 \u00b7 COUCHBASE",
        "emulator_service": "couchbase",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchbase",
        "service_banner": "honeypot-couchbase",
        "service_os": "linux",
        "dst_port": "8091"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.18,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchbase_emulated",
        "couchbase_payload",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742078313120726561647920706f72743d363030310d0a",
    "emulator_response_len": 34,
    "bytes_in": 157,
    "payload_entropy": 5.205161333279026,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "x11",
    "app_proto": "x11",
    "asn": 396982,
    "country": "US",
    "dst_port": 6001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0c5926f111b9778cba3fd4cbd1d2d6776e62ebc6",
    "event_fingerprint": "f9be7e9018a5680625474e3789d78248485a7d49",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "x11",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0de1e126ad64bb276098c974f98135e7",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6001,
        "service": "x11",
        "service_name": "x11",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af444cf117a4c5dc2c023f13702c4626d28b3cfc",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
        "port": 6001,
        "service": "x11",
        "service_label_fr": "X11"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
    "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
    "target_port_label": "6001 \u00b7 X11",
    "emulator_service": "x11",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "x11",
        "service_label_fr": "X11",
        "dst_port": 6001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-x11",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
            "port": 6001,
            "service": "x11",
            "service_label_fr": "X11"
        },
        "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Uzbl (Webkit 1.3) (Linux i686 [i686])\r\nAccept-Charset: utf-8\r\nAccept-Encoding",
        "target_port_label": "6001 \u00b7 X11",
        "emulator_service": "x11",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "x11",
        "service_banner": "honeypot-x11",
        "service_os": "linux",
        "dst_port": "6001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.1,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 239,
    "payload_entropy": 5.869666304219736,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "rtsp-alt",
    "app_proto": "rtsp-alt",
    "asn": 396982,
    "country": "US",
    "dst_port": 8554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "d5a36efc15d71e2ec9b3f719719470da181ff577",
    "event_fingerprint": "5dabfaf6a16fb1b5f072afe85ff4268481282545",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "rtsp-alt",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9c420f0a705c2913c067c3348f26173e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8554,
        "service": "rtsp-alt",
        "service_name": "rtsp-alt",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000baGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7\u0014VA\ufffd1\ufffd\ufffd\ufffdB\u000f\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdf\u000bJe\ufffd\ufffd\u0012\ufffd\ufffd\u001a'%D=%\u0019\ufffdT\u000eH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000baGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7\u0014VA\ufffd1\ufffd\ufffd\ufffdB\u000f\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdf\u000bJe\ufffd\ufffd\u0012\ufffd\ufffd\u001a'%D=%\u0019\ufffdT\u000eH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Z7\ufffd\ufffd\u0003\u0014\ufffd\u0012\ufffd\ufffd\ufffd\ufffdOY\u0001\u000bt\ufffdY\ufffd\u0014\ufffdu\u0016\ufffd59\ufffd\ufffd\u0003>",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000baGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7\u0014VA\ufffd1\ufffd\ufffd\ufffdB\u000f\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdf\u000bJe\ufffd\ufffd\u0012\ufffd\ufffd\u001a'%D=%\u0019\ufffdT\u000eH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f987ea6ae266adfb462c3b27d6fafa561175e09c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000baGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7\u0014VA\ufffd1\ufffd\ufffd\ufffdB\u000f\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdf\u000bJe\ufffd\ufffd\u0012\ufffd\ufffd\u001a'%D=%\u0019\ufffdT\u000eH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8554,
        "service": "rtsp-alt",
        "service_label_fr": "RTSP ALT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdaGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7VA\ufffd1\ufffd\ufffd\ufffdB\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdfJe\ufffd\ufffd\ufffd\ufffd'%D=%\ufffdTH&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
    "target_port_label": "8554 \u00b7 RTSP ALT",
    "emulator_service": "rtsp-alt",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP ALT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rtsp-alt",
        "service_label_fr": "RTSP ALT",
        "dst_port": 8554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp-alt",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000baGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7\u0014VA\ufffd1\ufffd\ufffd\ufffdB\u000f\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdf\u000bJe\ufffd\ufffd\u0012\ufffd\ufffd\u001a'%D=%\u0019\ufffdT\u000eH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8554,
            "service": "rtsp-alt",
            "service_label_fr": "RTSP ALT"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffdaGG\ufffd\ufffdU\ufffd\ufffd@\ufffd\u02e7VA\ufffd1\ufffd\ufffd\ufffdB\ufffdk\ufffd\ufffd\",\ufffd \ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u04d1\ufffd\ufffdfJe\ufffd\ufffd\ufffd\ufffd'%D=%\ufffdTH&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8554 \u00b7 RTSP ALT",
        "emulator_service": "rtsp-alt",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp_alt",
        "service_banner": "honeypot-rtsp-alt",
        "service_os": "linux",
        "dst_port": "8554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 14.05,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
    "emulator_response_len": 34,
    "bytes_in": 247,
    "payload_entropy": 5.440779853395353,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "redis",
    "app_proto": "redis",
    "asn": 396982,
    "country": "US",
    "dst_port": 6379,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 56,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "2e30779048c6e0466eab47d1a4261aca72134d7d",
    "event_fingerprint": "ad893b67498ef5007c1d8733f7eb11e5e6fc39df",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "redis",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa1d9f272beb9dd27db6a6041a89a828",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6379,
        "service": "redis",
        "service_name": "redis",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, like Gecko, Safari\/528.16) OmniWeb\/v622.8.0.112941\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML, like Gecko, Safari\/528.16) OmniWeb\/v622.8.0.112941\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1036563162979b0cdfefa81d3c63decab00f1b08",
    "protocol_details": {
        "redis_command_fr": "Sonde protocole Redis",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "port": 6379,
        "service": "redis",
        "service_label_fr": "REDIS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
    "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
    "target_port_label": "6379 \u00b7 REDIS",
    "emulator_service": "redis",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "redis",
        "service_label_fr": "REDIS",
        "dst_port": 6379,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Redis 7.0",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "redis_command_fr": "Sonde protocole Redis",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
            "port": 6379,
            "service": "redis",
            "service_label_fr": "REDIS"
        },
        "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit\/528.16 (KHTML,",
        "target_port_label": "6379 \u00b7 REDIS",
        "emulator_service": "redis",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "redis",
        "service_banner": "Redis 7.0",
        "service_os": "linux",
        "dst_port": "6379"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.92,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_slow",
        "net_port_scan_fast",
        "redis_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 239,
    "payload_entropy": 5.858647047416298,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 396982,
    "country": "US",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0a5fdd6a0b438b230b09a98fc924a5b02356a059",
    "event_fingerprint": "913d44813db075acdef68e978cb3225e3e208a9e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "adfc33f520f43a066990a8a52226960f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd`\ufffd\u0017\ufffd\ufffd3\u0010\ufffdfl\ufffd\u001f\ufffd\ufffdC\\\ufffd\b\u0018\ufffdk6\ufffdJ\u000e\ufffd\u0000\ufffd\u0006\u000b \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\u001c\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd`\ufffd\u0017\ufffd\ufffd3\u0010\ufffdfl\ufffd\u001f\ufffd\ufffdC\\\ufffd\b\u0018\ufffdk6\ufffdJ\u000e\ufffd\u0000\ufffd\u0006\u000b \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\u001c\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd,\ufffdNO\ufffd\u040c\ufffd\ufffd\ufffd6\u0017\ufffd\ufffd\ufffdQ\ufffd\u000fz\ufffd\ufffdu&\ufffd\ufffd\u0004\ubc96\ufffdm",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd`\ufffd\u0017\ufffd\ufffd3\u0010\ufffdfl\ufffd\u001f\ufffd\ufffdC\\\ufffd\b\u0018\ufffdk6\ufffdJ\u000e\ufffd\u0000\ufffd\u0006\u000b \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\u001c\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a358554c665734c5ebb04ef687e1b16ec3696de2",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd`\ufffd\u0017\ufffd\ufffd3\u0010\ufffdfl\ufffd\u001f\ufffd\ufffdC\\\ufffd\b\u0018\ufffdk6\ufffdJ\u000e\ufffd\u0000\ufffd\u0006\u000b \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\u001c\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd3\ufffdfl\ufffd\ufffd\ufffdC\\\ufffd\ufffdk6\ufffdJ\ufffd\ufffd \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KERBEROS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd`\ufffd\u0017\ufffd\ufffd3\u0010\ufffdfl\ufffd\u001f\ufffd\ufffdC\\\ufffd\b\u0018\ufffdk6\ufffdJ\u000e\ufffd\u0000\ufffd\u0006\u000b \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\u001c\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd3\ufffdfl\ufffd\ufffd\ufffdC\\\ufffd\ufffdk6\ufffdJ\ufffd\ufffd \ufffd@\ufffd4\ufffd\"m\ufffdA{3\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd*v;\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.87,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 242,
    "payload_entropy": 5.402654084435424,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "cassandra-jmx",
    "app_proto": "cassandra-jmx",
    "asn": 396982,
    "country": "US",
    "dst_port": 7000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "5cb1eb1c6e5a881f42f4c62b39f3d844c4cf8801",
    "event_fingerprint": "4757e40bf5bfa6ed554ee42d6be3813893ceaf98",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-jmx",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "532ade226c2ddb6b99fc89c01626115e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7000,
        "service": "cassandra-jmx",
        "service_name": "cassandra-jmx",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ef4a1524380379ef0e1b288af090f929bae64421",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
        "port": 7000,
        "service": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
    "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)",
    "target_port_label": "7000 \u00b7 CASSANDRA JMX",
    "emulator_service": "cassandra-jmx",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA JMX \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX",
        "dst_port": 7000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-jmx",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
            "port": 7000,
            "service": "cassandra-jmx",
            "service_label_fr": "CASSANDRA JMX"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA JMX:7000 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7000\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973U1) AppleWebKit\/537.36 (KHTML, like Gec",
        "target_port_label": "7000 \u00b7 CASSANDRA JMX",
        "emulator_service": "cassandra-jmx",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_jmx",
        "service_banner": "honeypot-cassandra-jmx",
        "service_os": "linux",
        "dst_port": "7000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.53,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "cassandra_emulated",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 185,
    "payload_entropy": 5.276675996884273,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 396982,
    "country": "US",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1938facaabc0cec679aaa075a8974ae654fdb7d2",
    "event_fingerprint": "ea0da68d73985439001a72e01b1268bfc3244e18",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "vnc",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f596ec5c699d40ec2ee294932c56ecaf",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "23d930a682627af83dfd75b9314da8978b76e4da",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
    "attack_vector": "port scan syn \u00b7 via VNC:5900 \u00b7 (reconnaissance)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port scan syn \u00b7 via VNC:5900 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/bots)\r\nAccept-Cha",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.49,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_port_scan_fast",
        "vnc_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "bytes_in": 239,
    "payload_entropy": 5.745722356479636,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 396982,
    "country": "US",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "8070529ea809db521e77d6c1e264f298470db612",
    "event_fingerprint": "ad0b471326720f66329abc8483052ac26a31da24",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7d6656dc60c35352afa4962bb2009732",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\ufffd\u001aT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\u001c\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt\u001c \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;\u0001a\ufffdy\u001d+\ufffdB\ufffd\ufffd3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\ufffd\u001aT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\u001c\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt\u001c \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;\u0001a\ufffdy\u001d+\ufffdB\ufffd\ufffd3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdG\tW\rj\ufffdJ!?{b\ufffd\b\ufffd\ufffd\ufffd\tn\ufffd\ufffd\ufffdQ\u3dfb\u00ed\ufffd!",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\ufffd\u001aT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\u001c\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt\u001c \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;\u0001a\ufffdy\u001d+\ufffdB\ufffd\ufffd3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "867ae1575812a180d3df7fbb33e62b6657537922",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\ufffd\u001aT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\u001c\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt\u001c \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;\u0001a\ufffdy\u001d+\ufffdB\ufffd\ufffd3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;a\ufffdy+\ufffdB\ufffd\ufffd3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffd\ufffd\ufffd\ufffd\u001aT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\u001c\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt\u001c \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;\u0001a\ufffdy\u001d+\ufffdB\ufffd\ufffd3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\\&\ufffd\ufffd\\\ufffd\ufffd\ufffdmN,0\ufffd\ufffd\ufffdF\u05d9BB\r\ufffdt \ufffd\r\ufffdw\ufffdP\ufffd0\ufffd\/\ufffd\ufffdwa\u0502\u022d\ufffdc;a\ufffdy+\ufffdB\ufffd\ufffd3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.43,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello",
        "tor_exit_probe",
        "tor_or_emulated",
        "tor_or_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206e656f346a5f6874747020726561647920706f72743d373437340d0a",
    "emulator_response_len": 41,
    "bytes_in": 186,
    "payload_entropy": 5.231875345452213,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "neo4j-http",
    "app_proto": "neo4j-http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7474,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e0c7387d5f5f4d78a437dd178beb4e9dc08a170f",
    "event_fingerprint": "728f2bebdda42ad97156188cffe1e575f6806d65",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "neo4j-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b95aa27ac38a61f71f8a0080b6d82467",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7474,
        "service": "neo4j-http",
        "service_name": "neo4j-http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dfc54dea497b9bf4eb1a68e07c38f076a5fee166",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
        "port": 7474,
        "service": "neo4j-http",
        "service_label_fr": "NEO4J HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
    "attack_vector": "port scan syn \u00b7 via NEO4J HTTP:7474 \u00b7 (reconnaissance)",
    "target_port_label": "7474 \u00b7 NEO4J HTTP",
    "emulator_service": "neo4j-http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NEO4J HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "neo4j-http",
        "service_label_fr": "NEO4J HTTP",
        "dst_port": 7474,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-neo4j-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
            "port": 7474,
            "service": "neo4j-http",
            "service_label_fr": "NEO4J HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NEO4J HTTP:7474 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Opera\/9.80 (Windows NT 5.1; U; zh-tw) Presto\/2.8.131 Version\/11.10\r\nAccept-Ch",
        "target_port_label": "7474 \u00b7 NEO4J HTTP",
        "emulator_service": "neo4j-http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "neo4j_http",
        "service_banner": "honeypot-neo4j-http",
        "service_os": "linux",
        "dst_port": "7474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.39,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "neo4j_http_emulated",
        "neo4j_http_payload",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 239,
    "payload_entropy": 5.754640966876275,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 396982,
    "country": "US",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "64b820d6f4fa4a36c94420b3980de526759b9358",
    "event_fingerprint": "6e151efbd186e8ea1864da9f779fb7a8521dca65",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c12e48a8ab475a726b6762a56cfe4f62",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u0007\u01a4\ufffd=4\ufffd\u0007\ufffd\u0014GX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\u0015\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\u0018\u0006\ufffd\ufffd\u0329 \ufffd~\ufffd\u0014B\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u0007\u01a4\ufffd=4\ufffd\u0007\ufffd\u0014GX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\u0015\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\u0018\u0006\ufffd\ufffd\u0329 \ufffd~\ufffd\u0014B\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 G\ufffdd'}\u0011\ufffd7\/S\ufffd\tn\tw\b\ufffd\u0523\ufffdF\ufffd\/\ufffd\u0188\ufffd\ufffdes\r7",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u0007\u01a4\ufffd=4\ufffd\u0007\ufffd\u0014GX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\u0015\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\u0018\u0006\ufffd\ufffd\u0329 \ufffd~\ufffd\u0014B\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "89555d64145b280657d2f5823dddbf1285873f99",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u0007\u01a4\ufffd=4\ufffd\u0007\ufffd\u0014GX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\u0015\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\u0018\u0006\ufffd\ufffd\u0329 \ufffd~\ufffd\u0014B\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "\ufffd\ufffd\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u01a4\ufffd=4\ufffd\ufffdGX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\ufffd\ufffd\u0329 \ufffd~\ufffdB&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CLICKHOUSE NATIVE \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u0007\u01a4\ufffd=4\ufffd\u0007\ufffd\u0014GX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\u0015\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\u0018\u0006\ufffd\ufffd\u0329 \ufffd~\ufffd\u0014B\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\u061c(\ufffda\ufffd8\ufffd\ufffd\ufffd\u01a4\ufffd=4\ufffd\ufffdGX\ufffd\ufffd\ufffdK\ufffd\u050f{\ufffd \u06cbp\ufffd\ufffd~\ufffd\ufffd\u07e1\u02f9C\u0667\ufffd*;\ufffd\ufffd\ufffd\u0329 \ufffd~\ufffdB&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 13.25,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a",
    "emulator_response_len": 42,
    "bytes_in": 180,
    "payload_entropy": 5.241563567556259,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "game-unreal",
    "app_proto": "game-unreal",
    "asn": 396982,
    "country": "US",
    "dst_port": 7777,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a6bbee5a2cf05467fb950101d0be90a51ee69959",
    "event_fingerprint": "0f97dacc0fa4c232914a20911ea8b2a3852db60e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "game-unreal",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9fe3247151e9f844fe7e1bbe8f86cacd",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7777,
        "service": "game-unreal",
        "service_name": "game-unreal",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "addc9b9808146b2d52002c8c765a92a217031438",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
        "port": 7777,
        "service": "game-unreal",
        "service_label_fr": "GAME UNREAL"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
    "attack_vector": "port scan syn \u00b7 via GAME UNREAL:7777 \u00b7 (reconnaissance)",
    "target_port_label": "7777 \u00b7 GAME UNREAL",
    "emulator_service": "game-unreal",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via GAME UNREAL \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "game-unreal",
        "service_label_fr": "GAME UNREAL",
        "dst_port": 7777,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-game-unreal",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
            "port": 7777,
            "service": "game-unreal",
            "service_label_fr": "GAME UNREAL"
        },
        "attack_vector": "port scan syn \u00b7 via GAME UNREAL:7777 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7777\r\nUser-Agent: Opera\/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto\/2.1.1\r\nAccept-Charset:",
        "target_port_label": "7777 \u00b7 GAME UNREAL",
        "emulator_service": "game-unreal",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "game_unreal",
        "service_banner": "honeypot-game-unreal",
        "service_os": "linux",
        "dst_port": "7777"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.89,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420646973636f72645f776562686f6f6b20726561647920706f72743d393031300d0a",
    "emulator_response_len": 46,
    "bytes_in": 239,
    "payload_entropy": 5.795446716726028,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "discord-webhook",
    "app_proto": "discord-webhook",
    "asn": 396982,
    "country": "US",
    "dst_port": 9010,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d75c197a719da7ea64ce53d3b3db6f72a43c332",
    "event_fingerprint": "39d54594e701e244c2723caf635668e85cc5977e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "discord-webhook",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fce9a461cea043a5b9e240f5554b63f8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9010,
        "service": "discord-webhook",
        "service_name": "discord-webhook",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\ufffd\ufffd\u000fS\u0001\u0006\u0016\ufffd\ufffdzP\ufffd\u7beb\u0002\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\u000b\ufffd\u0005\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\ufffd\ufffd\u000fS\u0001\u0006\u0016\ufffd\ufffdzP\ufffd\u7beb\u0002\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\u000b\ufffd\u0005\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 5O\u0007\ufffd\ufffd'\u0661\u0018s\ufffdsG\ufffd\u001b.^b\ufffd\ufffd@\u0004+\ufffd\/ijD\u001e\u05950",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\ufffd\ufffd\u000fS\u0001\u0006\u0016\ufffd\ufffdzP\ufffd\u7beb\u0002\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\u000b\ufffd\u0005\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "06139c43b305b637373896685d31234e5e7f58a5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\ufffd\ufffd\u000fS\u0001\u0006\u0016\ufffd\ufffdzP\ufffd\u7beb\u0002\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\u000b\ufffd\u0005\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9010,
        "service": "discord-webhook",
        "service_label_fr": "Webhook Discord"
    },
    "evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\ufffdS\ufffd\ufffdzP\ufffd\u7beb\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
    "target_port_label": "9010 \u00b7 Webhook Discord",
    "emulator_service": "discord-webhook",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook Discord \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "discord-webhook",
        "service_label_fr": "Webhook Discord",
        "dst_port": 9010,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-discord-webhook",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\ufffd\ufffd\u000fS\u0001\u0006\u0016\ufffd\ufffdzP\ufffd\u7beb\u0002\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\u000b\ufffd\u0005\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9010,
            "service": "discord-webhook",
            "service_label_fr": "Webhook Discord"
        },
        "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd\ufffdS\ufffd\ufffdzP\ufffd\u7beb\ufffd\ufffd\ufffd\u01a0Z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd0\ufffdV\u052e4v\ufffd\ufffdG \ufffd\ufffd|u\nt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffdGjx\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9010 \u00b7 Webhook Discord",
        "emulator_service": "discord-webhook",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "discord_webhook",
        "service_banner": "honeypot-discord-webhook",
        "service_os": "linux",
        "dst_port": "9010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.63,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "discord_webhook_emulated",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420636f7563686261736520726561647920706f72743d383039310d0a",
    "emulator_response_len": 40,
    "bytes_in": 237,
    "payload_entropy": 5.392378681506124,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "couchbase",
    "app_proto": "couchbase",
    "asn": 396982,
    "country": "US",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 52,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "d4641686409c50dcb5157b10bcb99a5130df2cd1",
    "event_fingerprint": "3b60071144288aefe5f7d3a92b0e4863e95fe8f5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 52,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "couchbase",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7efdcd5eb9dae891464b7dcfdea8e4a1",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "couchbase",
        "service_name": "couchbase",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "830645fceec320e626a5a54057260ae60b849ac6",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "port": 8091,
        "service": "couchbase",
        "service_label_fr": "COUCHBASE"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
    "attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
    "target_port_label": "8091 \u00b7 COUCHBASE",
    "emulator_service": "couchbase",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COUCHBASE \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 52,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "couchbase",
        "service_label_fr": "COUCHBASE",
        "dst_port": 8091,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchbase",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
            "port": 8091,
            "service": "couchbase",
            "service_label_fr": "COUCHBASE"
        },
        "attack_vector": "port scan syn \u00b7 via COUCHBASE:8091 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8091\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; PH-1) AppleWebKit\/537.36 (KHTML, like Gecko) C",
        "target_port_label": "8091 \u00b7 COUCHBASE",
        "emulator_service": "couchbase",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchbase",
        "service_banner": "honeypot-couchbase",
        "service_os": "linux",
        "dst_port": "8091"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.59,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "couchbase_emulated",
        "couchbase_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "840000000200000002",
    "emulator_response_len": 9,
    "bytes_in": 239,
    "payload_entropy": 5.880853506777456,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "cassandra",
    "app_proto": "cassandra",
    "asn": 396982,
    "country": "US",
    "dst_port": 9042,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1eb224c59edf8413b288ee628e1014b3b6adc2bd",
    "event_fingerprint": "26d8e48a1f6752aca7f9494557834abf00d18b90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "871593fbdf724acfba85829ce6744715",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9042,
        "service": "cassandra",
        "service_name": "cassandra",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u001d\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd\u0018(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdR\u0006z)\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u001d\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd\u0018(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdR\u0006z)\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 e\ufffd\u001b\u0163\u0014\ufffd\ufffdR\ufffd\ufffd\u0018cA\u0010\ufffdL\ufffd\ufffd[\ufffd\u069f\u001a\ufffd\u001eT8\ufffd\ufffd&R",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u001d\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd\u0018(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdR\u0006z)\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "999fce510a3429b68c45889c451f90e26325014a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u001d\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd\u0018(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdR\u0006z)\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9042,
        "service": "cassandra",
        "service_label_fr": "CASSANDRA"
    },
    "evidence_snippet": "\ufffd\ufffd-\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdRz)\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
    "target_port_label": "9042 \u00b7 CASSANDRA",
    "emulator_service": "cassandra",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cassandra",
        "service_label_fr": "CASSANDRA",
        "dst_port": 9042,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u001d\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd\u0018(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdR\u0006z)\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9042,
            "service": "cassandra",
            "service_label_fr": "CASSANDRA"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd-\ufffdk\ufffd\ufffd4{\ufffd\ufffdzV\ufffd\ufffd$F\ufffd\ufffdG\u0610\ufffdH\ufffd\/\ufffdBC\ufffdT\u010c PN\ufffd\ufffd\ufffd(M\ufffd\ufffd`\ufffd-\ufffd\"m\ufffd\"$\">*\ufffd\ufffd\ufffd\ufffdRz)\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9042 \u00b7 CASSANDRA",
        "emulator_service": "cassandra",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra",
        "service_banner": "honeypot-cassandra",
        "service_os": "linux",
        "dst_port": "9042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.54,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 223,
    "payload_entropy": 5.450614365180357,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "rtsp-alt",
    "app_proto": "rtsp-alt",
    "asn": 396982,
    "country": "US",
    "dst_port": 8554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "4f181913d3051d671e8b883d14816cc1f5a9fdfc",
    "event_fingerprint": "5dabfaf6a16fb1b5f072afe85ff4268481282545",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "rtsp-alt",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2f86f3db6214068794f22ca8b83c65ed",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8554,
        "service": "rtsp-alt",
        "service_name": "rtsp-alt",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bdb6181ceea36d78a9b12d63a0dcafbc718afb4d",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
        "port": 8554,
        "service": "rtsp-alt",
        "service_label_fr": "RTSP ALT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
    "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
    "target_port_label": "8554 \u00b7 RTSP ALT",
    "emulator_service": "rtsp-alt",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP ALT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "rtsp-alt",
        "service_label_fr": "RTSP ALT",
        "dst_port": 8554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp-alt",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
            "port": 8554,
            "service": "rtsp-alt",
            "service_label_fr": "RTSP ALT"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8554\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
        "target_port_label": "8554 \u00b7 RTSP ALT",
        "emulator_service": "rtsp-alt",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp_alt",
        "service_banner": "honeypot-rtsp-alt",
        "service_os": "linux",
        "dst_port": "8554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.5,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
    "emulator_response_len": 45,
    "bytes_in": 239,
    "payload_entropy": 5.89489903729206,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "github-webhook",
    "app_proto": "github-webhook",
    "asn": 396982,
    "country": "US",
    "dst_port": 9011,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b907be28708b174e06088c05ca14e87565710095",
    "event_fingerprint": "71ec2dab51a1e3f07d3fc9149e1aeaeecec34699",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "github-webhook",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fb323fd8b3aa8c56e41d3de504e9220b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9011,
        "service": "github-webhook",
        "service_name": "github-webhook",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A`\rjH\ufffd\ufffdw\ry\ufffdb\u0006M\ufffd\ufffd\ufffd\ufffdov\ufffd\u0005\u00174.\ufffd\ufffd\ufffd\ufffd)\ufffd\u0003 u\u0016\ufffd\ufffdn\ufffd\ufffd\ufffd\u000f\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\u001d\ufffd>\ufffd\u001d=YWw\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A`\rjH\ufffd\ufffdw\ry\ufffdb\u0006M\ufffd\ufffd\ufffd\ufffdov\ufffd\u0005\u00174.\ufffd\ufffd\ufffd\ufffd)\ufffd\u0003 u\u0016\ufffd\ufffdn\ufffd\ufffd\ufffd\u000f\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\u001d\ufffd>\ufffd\u001d=YWw\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd]\r\ufffd\u0010;\ufffd]\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd5\ufffd|\u04284v\ufffd\ufffdm",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A`\rjH\ufffd\ufffdw\ry\ufffdb\u0006M\ufffd\ufffd\ufffd\ufffdov\ufffd\u0005\u00174.\ufffd\ufffd\ufffd\ufffd)\ufffd\u0003 u\u0016\ufffd\ufffdn\ufffd\ufffd\ufffd\u000f\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\u001d\ufffd>\ufffd\u001d=YWw\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "539a719e214d013d1c69c903eea60fccaceb37f1",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A`\rjH\ufffd\ufffdw\ry\ufffdb\u0006M\ufffd\ufffd\ufffd\ufffdov\ufffd\u0005\u00174.\ufffd\ufffd\ufffd\ufffd)\ufffd\u0003 u\u0016\ufffd\ufffdn\ufffd\ufffd\ufffd\u000f\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\u001d\ufffd>\ufffd\u001d=YWw\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9011,
        "service": "github-webhook",
        "service_label_fr": "Webhook GitHub"
    },
    "evidence_snippet": "\ufffd\ufffdA`\rjH\ufffd\ufffdw\ry\ufffdbM\ufffd\ufffd\ufffd\ufffdov\ufffd4.\ufffd\ufffd\ufffd\ufffd)\ufffd u\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\ufffd>\ufffd=YWw\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
    "target_port_label": "9011 \u00b7 Webhook GitHub",
    "emulator_service": "github-webhook",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "github-webhook",
        "service_label_fr": "Webhook GitHub",
        "dst_port": 9011,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-github-webhook",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A`\rjH\ufffd\ufffdw\ry\ufffdb\u0006M\ufffd\ufffd\ufffd\ufffdov\ufffd\u0005\u00174.\ufffd\ufffd\ufffd\ufffd)\ufffd\u0003 u\u0016\ufffd\ufffdn\ufffd\ufffd\ufffd\u000f\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\u001d\ufffd>\ufffd\u001d=YWw\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9011,
            "service": "github-webhook",
            "service_label_fr": "Webhook GitHub"
        },
        "attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdA`\rjH\ufffd\ufffdw\ry\ufffdbM\ufffd\ufffd\ufffd\ufffdov\ufffd4.\ufffd\ufffd\ufffd\ufffd)\ufffd u\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffdH\ufffdb!\ufffdU\ufffd\ufffd>\ufffd=YWw\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9011 \u00b7 Webhook GitHub",
        "emulator_service": "github-webhook",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "github_webhook",
        "service_banner": "honeypot-github-webhook",
        "service_os": "linux",
        "dst_port": "9011"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.46,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "github_webhook_emulated",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a",
    "emulator_response_len": 40,
    "bytes_in": 239,
    "payload_entropy": 5.772762011672308,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "jetdirect",
    "app_proto": "jetdirect",
    "asn": 396982,
    "country": "US",
    "dst_port": 9100,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "61de5982fe9d05217541ffc0a8c1564efe6047a5",
    "event_fingerprint": "e5f6d388fd423bb3ac152e459ee5a2de6bcef8cd",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "jetdirect",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "72b6021f93e344815d264398203269e8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9100,
        "service": "jetdirect",
        "service_name": "jetdirect",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\\\ufffdH\ufffdC\u0003\u001b\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\u0000\n\ufffd\ufffd\ufffd\u001aA\ufffd\ufffd\ufffd Ju\ufffdW\fr\u001c\ufffdr\f\ufffd\ufffd_\u00133\f[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\\\ufffdH\ufffdC\u0003\u001b\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\u0000\n\ufffd\ufffd\ufffd\u001aA\ufffd\ufffd\ufffd Ju\ufffdW\fr\u001c\ufffdr\f\ufffd\ufffd_\u00133\f[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0013\ufffd\ufffd\u0361\ufffd-\ufffdo\ufffd,\ufffd\ufffd\ufffd\u00057\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\ufffd1vY\\W$",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\\\ufffdH\ufffdC\u0003\u001b\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\u0000\n\ufffd\ufffd\ufffd\u001aA\ufffd\ufffd\ufffd Ju\ufffdW\fr\u001c\ufffdr\f\ufffd\ufffd_\u00133\f[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "943a47a0bc4ee70221781ff5188de909a8209a84",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\\\ufffdH\ufffdC\u0003\u001b\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\u0000\n\ufffd\ufffd\ufffd\u001aA\ufffd\ufffd\ufffd Ju\ufffdW\fr\u001c\ufffdr\f\ufffd\ufffd_\u00133\f[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9100,
        "service": "jetdirect",
        "service_label_fr": "JETDIRECT"
    },
    "evidence_snippet": "\ufffd\ufffdJ\\\ufffdH\ufffdC\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\n\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd Ju\ufffdWr\ufffdr\ufffd\ufffd_3[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
    "target_port_label": "9100 \u00b7 JETDIRECT",
    "emulator_service": "jetdirect",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JETDIRECT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "jetdirect",
        "service_label_fr": "JETDIRECT",
        "dst_port": 9100,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-jetdirect",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\\\ufffdH\ufffdC\u0003\u001b\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\u0000\n\ufffd\ufffd\ufffd\u001aA\ufffd\ufffd\ufffd Ju\ufffdW\fr\u001c\ufffdr\f\ufffd\ufffd_\u00133\f[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9100,
            "service": "jetdirect",
            "service_label_fr": "JETDIRECT"
        },
        "attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdJ\\\ufffdH\ufffdC\ufffd\ufffd\ufffd\ufffdplu\u14cdz\u0749\ufffd\n\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd Ju\ufffdWr\ufffdr\ufffd\ufffd_3[+x\ufffd\"M\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9100 \u00b7 JETDIRECT",
        "emulator_service": "jetdirect",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "jetdirect",
        "service_banner": "honeypot-jetdirect",
        "service_os": "linux",
        "dst_port": "9100"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.39,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 250,
    "payload_entropy": 5.3730116065374816,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 396982,
    "country": "US",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "17ae1ecddd333a00cdbe735f40a3c59f435cc6ae",
    "event_fingerprint": "913d44813db075acdef68e978cb3225e3e208a9e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a03ada06ccc50076352147391b93c039",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13C75 Safari\/601.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13C75 Safari\/601.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d0e166b9a78476e788e1710ab420d719ca635489",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
    "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KERBEROS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit\/601.1.46 (KHT",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 12.31,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "bytes_in": 191,
    "payload_entropy": 5.29132546037791,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 396982,
    "country": "US",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "50a5aff27bf8bfde4aeb4518c267cae7272ef886",
    "event_fingerprint": "ad0b471326720f66329abc8483052ac26a31da24",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "53466165d57a92bb2960545fdac0a4e5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20d540fb112a03173f1d9bcd4d72d7825ee03d20",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
    "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAcce",
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.99,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast",
        "tor_exit_probe",
        "tor_or_emulated",
        "tor_or_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 263,
    "payload_entropy": 5.28891972106226,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 396982,
    "country": "US",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 55,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "28aec99a538540a2d8215891c2ecb500a6291f3f",
    "event_fingerprint": "6e151efbd186e8ea1864da9f779fb7a8521dca65",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a48057abdf8ae2e2e5e017e9ec6d7101",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .NET CLR 3.7.50745; Media Center PC 6.0; Zune 4.7; .NET4.0C; en-MT)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .NET CLR 3.7.50745; Media Center PC 6.0; Zune 4.7; .NET4.0C; en-MT)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c0339050ca77746d128d563867135ab77febcbdc",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
    "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CLICKHOUSE NATIVE \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Win64; x64; Trident\/5.0; .",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.86,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "45530000002d0000000000000000000000000000000000000000000000000000000000000000000000000000000000372e31372e3900",
    "emulator_response_len": 54,
    "bytes_in": 239,
    "payload_entropy": 5.877298028855458,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "elasticsearch-transport",
    "app_proto": "elasticsearch-transport",
    "asn": 396982,
    "country": "US",
    "dst_port": 9300,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "bccac9fd03b9cce02abf54ee0a3e2d9b14fee2fd",
    "event_fingerprint": "8651aba44bd8853f765b0eefe758b7b5daf16675",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch-transport",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6853da1c12bc6de15937fb6dcc774dd",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9300,
        "service": "elasticsearch-transport",
        "service_name": "elasticsearch-transport",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\t\ufffd\u000b~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\u0006{'\ufffd\ufffd\u0456\u05b7\u0012q\u0004\ufffdT \ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0004o\ufffd\ufffd\ufffd\u0003\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\t\ufffd\u000b~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\u0006{'\ufffd\ufffd\u0456\u05b7\u0012q\u0004\ufffdT \ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0004o\ufffd\ufffd\ufffd\u0003\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ?\ufffd\ufffdU\\\u001c\ufffduau$P\ufffd\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd\u0005*\u0018\ufffd?\ufffd\ufffd\ufffd?X\ufffd\u0019",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\t\ufffd\u000b~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\u0006{'\ufffd\ufffd\u0456\u05b7\u0012q\u0004\ufffdT \ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0004o\ufffd\ufffd\ufffd\u0003\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf7b5a338415f0f1f20622fa1d7a0b546d895bb6",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\t\ufffd\u000b~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\u0006{'\ufffd\ufffd\u0456\u05b7\u0012q\u0004\ufffdT \ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0004o\ufffd\ufffd\ufffd\u0003\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9300,
        "service": "elasticsearch-transport",
        "service_label_fr": "ELASTICSEARCH TRANSPORT"
    },
    "evidence_snippet": "\ufffd\ufffdv\t\ufffd~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd{'\ufffd\ufffd\u0456\u05b7q\ufffdT \ufffd\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (reconnaissance)",
    "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT",
    "emulator_service": "elasticsearch-transport",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ELASTICSEARCH TRANSPORT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "elasticsearch-transport",
        "service_label_fr": "ELASTICSEARCH TRANSPORT",
        "dst_port": 9300,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-elasticsearch-transport",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\t\ufffd\u000b~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\u0006{'\ufffd\ufffd\u0456\u05b7\u0012q\u0004\ufffdT \ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0004o\ufffd\ufffd\ufffd\u0003\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9300,
            "service": "elasticsearch-transport",
            "service_label_fr": "ELASTICSEARCH TRANSPORT"
        },
        "attack_vector": "port scan syn \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdv\t\ufffd~dL\ufffd<\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd{'\ufffd\ufffd\u0456\u05b7q\ufffdT \ufffd\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\\\ufffdE-%\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT",
        "emulator_service": "elasticsearch-transport",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch_transport",
        "service_banner": "honeypot-elasticsearch-transport",
        "service_os": "linux",
        "dst_port": "9300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.69,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "elasticsearch_tcp_probe",
        "elasticsearch_transport",
        "elasticsearch_transport_emulated",
        "elasticsearch_transport_payload",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420646973636f72645f776562686f6f6b20726561647920706f72743d393031300d0a",
    "emulator_response_len": 46,
    "bytes_in": 218,
    "payload_entropy": 5.361690006592173,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "discord-webhook",
    "app_proto": "discord-webhook",
    "asn": 396982,
    "country": "US",
    "dst_port": 9010,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "638d6df59d618d0b112d7ae7c555c22d6fc74784",
    "event_fingerprint": "39d54594e701e244c2723caf635668e85cc5977e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "discord-webhook",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8e4c0cabe662429cdada9cccd81d3a40",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9010,
        "service": "discord-webhook",
        "service_name": "discord-webhook",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/7.0 (like Firefox\/7.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/7.0 (like Firefox\/7.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1067bfaa358d8c6048cb355bd1068495562dab66",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
        "port": 9010,
        "service": "discord-webhook",
        "service_label_fr": "Webhook Discord"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
    "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
    "target_port_label": "9010 \u00b7 Webhook Discord",
    "emulator_service": "discord-webhook",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook Discord \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "discord-webhook",
        "service_label_fr": "Webhook Discord",
        "dst_port": 9010,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-discord-webhook",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
            "port": 9010,
            "service": "discord-webhook",
            "service_label_fr": "Webhook Discord"
        },
        "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9010\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko\/20110430 shadowfox\/",
        "target_port_label": "9010 \u00b7 Webhook Discord",
        "emulator_service": "discord-webhook",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "discord_webhook",
        "service_banner": "honeypot-discord-webhook",
        "service_os": "linux",
        "dst_port": "9010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.35,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "discord_webhook_emulated",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "840000000200000002",
    "emulator_response_len": 9,
    "bytes_in": 245,
    "payload_entropy": 5.426142430461928,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "cassandra",
    "app_proto": "cassandra",
    "asn": 396982,
    "country": "US",
    "dst_port": 9042,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c5e301b65bf0ccf57d5fc54d8cc9ab5def7de4fd",
    "event_fingerprint": "26d8e48a1f6752aca7f9494557834abf00d18b90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2f261b95f0b1aeb8af890af48dd62312",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9042,
        "service": "cassandra",
        "service_name": "cassandra",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "725e133c3cc0f906af37e182a3171408575cc236",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
        "port": 9042,
        "service": "cassandra",
        "service_label_fr": "CASSANDRA"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
    "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
    "target_port_label": "9042 \u00b7 CASSANDRA",
    "emulator_service": "cassandra",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "cassandra",
        "service_label_fr": "CASSANDRA",
        "dst_port": 9042,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
            "port": 9042,
            "service": "cassandra",
            "service_label_fr": "CASSANDRA"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHTML, like",
        "target_port_label": "9042 \u00b7 CASSANDRA",
        "emulator_service": "cassandra",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra",
        "service_banner": "honeypot-cassandra",
        "service_os": "linux",
        "dst_port": "9042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.27,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "cassandra_emulated",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
    "emulator_response_len": 45,
    "bytes_in": 245,
    "payload_entropy": 5.397545362950463,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "github-webhook",
    "app_proto": "github-webhook",
    "asn": 396982,
    "country": "US",
    "dst_port": 9011,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1122d8ad32aa87b503ab508296f0e4282991360c",
    "event_fingerprint": "71ec2dab51a1e3f07d3fc9149e1aeaeecec34699",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "github-webhook",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a75a8976873f736b0e945defe4ff7d58",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9011,
        "service": "github-webhook",
        "service_name": "github-webhook",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fb4c8758c1066d159dc1a27cc9a5ec11cc72fc44",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
        "port": 9011,
        "service": "github-webhook",
        "service_label_fr": "Webhook GitHub"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
    "attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
    "target_port_label": "9011 \u00b7 Webhook GitHub",
    "emulator_service": "github-webhook",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook GitHub \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "github-webhook",
        "service_label_fr": "Webhook GitHub",
        "dst_port": 9011,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-github-webhook",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
            "port": 9011,
            "service": "github-webhook",
            "service_label_fr": "Webhook GitHub"
        },
        "attack_vector": "port scan syn \u00b7 via Webhook GitHub:9011 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9011\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit\/537.36 (KHTML, like",
        "target_port_label": "9011 \u00b7 Webhook GitHub",
        "emulator_service": "github-webhook",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "github_webhook",
        "service_banner": "honeypot-github-webhook",
        "service_os": "linux",
        "dst_port": "9011"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.24,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "github_webhook_emulated",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a",
    "emulator_response_len": 40,
    "bytes_in": 245,
    "payload_entropy": 5.402761695354988,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "jetdirect",
    "app_proto": "jetdirect",
    "asn": 396982,
    "country": "US",
    "dst_port": 9100,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "0e4e2c4874a6ce323c549066ffff74a8001255c4",
    "event_fingerprint": "e5f6d388fd423bb3ac152e459ee5a2de6bcef8cd",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "jetdirect",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "be06e6cbdb1b8af1405826dfe8843347",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9100,
        "service": "jetdirect",
        "service_name": "jetdirect",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "26c64b056f7eec74f8caa4998739dc5a3f7cdc8c",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
        "port": 9100,
        "service": "jetdirect",
        "service_label_fr": "JETDIRECT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
    "attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
    "target_port_label": "9100 \u00b7 JETDIRECT",
    "emulator_service": "jetdirect",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JETDIRECT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "jetdirect",
        "service_label_fr": "JETDIRECT",
        "dst_port": 9100,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-jetdirect",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
            "port": 9100,
            "service": "jetdirect",
            "service_label_fr": "JETDIRECT"
        },
        "attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9100\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
        "target_port_label": "9100 \u00b7 JETDIRECT",
        "emulator_service": "jetdirect",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "jetdirect",
        "service_banner": "honeypot-jetdirect",
        "service_os": "linux",
        "dst_port": "9100"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 11.15,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 239,
    "payload_entropy": 5.903597193317957,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "postgres",
    "app_proto": "postgres",
    "asn": 396982,
    "country": "US",
    "dst_port": 5432,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2807753a2f8a454a328487199fb31ab6c07890c",
    "event_fingerprint": "5302d14dbea4b63204d1ed61b172d5e31032aca7",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "postgres",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6769dac722b3187fa08b98a592f07883",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5432,
        "service": "postgres",
        "service_name": "postgres",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\u0012qa\ufffd\u0002\ufffd\u0019D\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\u0018\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\u0016\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\u0012qa\ufffd\u0002\ufffd\u0019D\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\u0018\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\u0016\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 r\u0013\ufffd\ufffd\ufffd\u0288\ufffd\ufffd%\n\ufffd\ufffd\ufffd%\u01a6K\ufffd\ufffdO\ufffd\ufffd\u0011\ufffd9\ufffd\ufffdf@\ufffdk",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\u0012qa\ufffd\u0002\ufffd\u0019D\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\u0018\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\u0016\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d190c50a2d74530c515fbaf086b1418e7b4240e6",
    "protocol_details": {
        "postgres_startup_fr": "Handshake PostgreSQL (startup)",
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\u0012qa\ufffd\u0002\ufffd\u0019D\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\u0018\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\u0016\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 5432,
        "service": "postgres",
        "service_label_fr": "POSTGRES"
    },
    "evidence_snippet": "\ufffd\ufffdVqa\ufffd\ufffdD\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
    "target_port_label": "5432 \u00b7 POSTGRES",
    "emulator_service": "postgres",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via POSTGRES \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "postgres",
        "service_label_fr": "POSTGRES",
        "dst_port": 5432,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "PostgreSQL 15.4",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "postgres_startup_fr": "Handshake PostgreSQL (startup)",
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\u0012qa\ufffd\u0002\ufffd\u0019D\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\u0018\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\u0016\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 5432,
            "service": "postgres",
            "service_label_fr": "POSTGRES"
        },
        "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdVqa\ufffd\ufffdD\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffdSz\ufffdp\ufffd5C\ufffdv\ufffd\ufffd. y\u03d5\ufffd\ufffdbP\ufffd\u02ea\ufffdz_\ufffd0\ufffdq\ufffd6\ufffd\ufffd8\ufffddm\ufffdu:\ufffdM&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "5432 \u00b7 POSTGRES",
        "emulator_service": "postgres",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "postgres",
        "service_banner": "PostgreSQL 15.4",
        "service_os": "linux",
        "dst_port": "5432"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 10.4,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_port_scan_fast",
        "postgres_emulated",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "45530000002d0000000000000000000000000000000000000000000000000000000000000000000000000000000000372e31372e3900",
    "emulator_response_len": 54,
    "bytes_in": 257,
    "payload_entropy": 5.476986360587365,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "elasticsearch-transport",
    "app_proto": "elasticsearch-transport",
    "asn": 396982,
    "country": "US",
    "dst_port": 9300,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 53,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "1d12868b9969aa5a7863e5fa0e8f9d112a0892b7",
    "event_fingerprint": "8651aba44bd8853f765b0eefe758b7b5daf16675",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch-transport",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "447c3f48ed99822e741e45086e2d72b5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9300,
        "service": "elasticsearch-transport",
        "service_name": "elasticsearch-transport",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36 ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.84 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.84 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e79ac44e1da70140b06365a3090278a953dd81cc",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
        "port": 9300,
        "service": "elasticsearch-transport",
        "service_label_fr": "ELASTICSEARCH TRANSPORT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
    "attack_vector": "port scan syn \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (reconnaissance)",
    "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT",
    "emulator_service": "elasticsearch-transport",
    "confidence_reason": "Confiance 100 % \u2014 7 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ELASTICSEARCH TRANSPORT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "elasticsearch-transport",
        "service_label_fr": "ELASTICSEARCH TRANSPORT",
        "dst_port": 9300,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-elasticsearch-transport",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
            "port": 9300,
            "service": "elasticsearch-transport",
            "service_label_fr": "ELASTICSEARCH TRANSPORT"
        },
        "attack_vector": "port scan syn \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; SCH-R970 Build\/LRX22C) AppleWebKit\/537.36",
        "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT",
        "emulator_service": "elasticsearch-transport",
        "confidence_reason": "Confiance 100 % \u2014 7 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch_transport",
        "service_banner": "honeypot-elasticsearch-transport",
        "service_os": "linux",
        "dst_port": "9300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 28,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 28,
    "scan_velocity_ports_per_s": 9.26,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "elasticsearch_tcp_probe",
        "elasticsearch_transport",
        "elasticsearch_transport_emulated",
        "elasticsearch_transport_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_port_scan_fast"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "bytes_in": 239,
    "payload_entropy": 5.868358524111887,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 396982,
    "country": "US",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "8070529ea809db521e77d6c1e264f298470db612",
    "event_fingerprint": "ad0b471326720f66329abc8483052ac26a31da24",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "70f127439b0f75dfffffec7b21eb408c",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R]VB\u00077\ufffd%\u0001\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5\u0006F\u000b\ufffd\ufffd%^\ufffd\u0017\ufffdQS \ufffd\f\u0017\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[\u00164\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R]VB\u00077\ufffd%\u0001\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5\u0006F\u000b\ufffd\ufffd%^\ufffd\u0017\ufffdQS \ufffd\f\u0017\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[\u00164\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\\\ufffd\ufffd\ufffd\u0015\ufffd\u000f\ufffd0-V\u0468z\ufffd\ufffdc\ufffd-\ufffds\ufffdRz\ufffd\ufffd\ufffd\ufffd\ufffd\n",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R]VB\u00077\ufffd%\u0001\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5\u0006F\u000b\ufffd\ufffd%^\ufffd\u0017\ufffdQS \ufffd\f\u0017\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[\u00164\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fd59d107ffbd8f7e89dc60af3293eb097fb0d8c4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R]VB\u00077\ufffd%\u0001\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5\u0006F\u000b\ufffd\ufffd%^\ufffd\u0017\ufffdQS \ufffd\f\u0017\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[\u00164\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "evidence_snippet": "\ufffd\ufffdR]VB7\ufffd%\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5F\ufffd\ufffd%^\ufffd\ufffdQS \ufffd\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[4\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R]VB\u00077\ufffd%\u0001\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5\u0006F\u000b\ufffd\ufffd%^\ufffd\u0017\ufffdQS \ufffd\f\u0017\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[\u00164\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdR]VB7\ufffd%\ufffd8\ufffd_\ufffd\ufffd\ufffdc\ufffd5F\ufffd\ufffd%^\ufffd\ufffdQS \ufffd\ufffd?\ufffd\ufffd6d;P\ufffdK\u042e\ufffd\ufffd\ufffd\ufffd[4\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 21,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091,
        8554
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 21,
    "scan_velocity_ports_per_s": 25.27,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "tls_clienthello",
        "tor_exit_probe",
        "tor_or_emulated",
        "tor_or_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 239,
    "payload_entropy": 5.900759731794002,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 396982,
    "country": "US",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "64b820d6f4fa4a36c94420b3980de526759b9358",
    "event_fingerprint": "6e151efbd186e8ea1864da9f779fb7a8521dca65",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "048991eaf95ba13d51e09feeb7b1ce4c",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffd-\ufffd\ufffd\/V\ufffd'\u001a\ufffd\ufffd=\u0000F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd\u0004 \u001f\ufffd \ufffd?\u0010W\ufffd\ufffdz\ufffdgZ\ufffd\u000f\u0014~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\u001c\ufffd6S.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffd-\ufffd\ufffd\/V\ufffd'\u001a\ufffd\ufffd=\u0000F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd\u0004 \u001f\ufffd \ufffd?\u0010W\ufffd\ufffdz\ufffdgZ\ufffd\u000f\u0014~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\u001c\ufffd6S.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd{\ufffd\ufffd8Y6\ufffd\u001e\ufffd\ufffd\u001f\ufffdr\ufffd\u001c\ufffd7\u02ccJR\u0017B\u0016\ufffd\ufffdp\ufffd\u0014",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffd-\ufffd\ufffd\/V\ufffd'\u001a\ufffd\ufffd=\u0000F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd\u0004 \u001f\ufffd \ufffd?\u0010W\ufffd\ufffdz\ufffdgZ\ufffd\u000f\u0014~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\u001c\ufffd6S.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3791120cc097a1507fb6831608759c320473cf4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffd-\ufffd\ufffd\/V\ufffd'\u001a\ufffd\ufffd=\u0000F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd\u0004 \u001f\ufffd \ufffd?\u0010W\ufffd\ufffdz\ufffdgZ\ufffd\u000f\u0014~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\u001c\ufffd6S.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "\ufffd\ufffdR\ufffd-\ufffd\ufffd\/V\ufffd'\ufffd\ufffd=F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd \ufffd \ufffd?W\ufffd\ufffdz\ufffdgZ\ufffd~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\ufffd6S.&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CLICKHOUSE NATIVE \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffd-\ufffd\ufffd\/V\ufffd'\u001a\ufffd\ufffd=\u0000F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd\u0004 \u001f\ufffd \ufffd?\u0010W\ufffd\ufffdz\ufffdgZ\ufffd\u000f\u0014~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\u001c\ufffd6S.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdR\ufffd-\ufffd\ufffd\/V\ufffd'\ufffd\ufffd=F\ufffdw\ufffd;9l\ufffd\ufffd\ufffdY\u0503\ufffd \ufffd \ufffd?W\ufffd\ufffdz\ufffdgZ\ufffd~2\ufffd\u067d\ufffd\u0614\ufffdw\ufffdN\ufffd\ufffd\ufffd6S.&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 22,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091,
        8554
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 22,
    "scan_velocity_ports_per_s": 25.79,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420646973636f72645f776562686f6f6b20726561647920706f72743d393031300d0a",
    "emulator_response_len": 46,
    "bytes_in": 239,
    "payload_entropy": 5.8442334765457655,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "discord-webhook",
    "app_proto": "discord-webhook",
    "asn": 396982,
    "country": "US",
    "dst_port": 9010,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d75c197a719da7ea64ce53d3b3db6f72a43c332",
    "event_fingerprint": "39d54594e701e244c2723caf635668e85cc5977e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "discord-webhook",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4689a26f50e26d9e190b28e96808c148",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9010,
        "service": "discord-webhook",
        "service_name": "discord-webhook",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ\u023a\ufffd\ufffd\u02d1\u000b\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\u0015\ufffd\ufffd\u0014\ufffdZ\"\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0019@\ufffd\u0013<\ufffd*\ufffd\u01b5+\ufffd\\\u0015\ufffd\ufffdl\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ\u023a\ufffd\ufffd\u02d1\u000b\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\u0015\ufffd\ufffd\u0014\ufffdZ\"\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0019@\ufffd\u0013<\ufffd*\ufffd\u01b5+\ufffd\\\u0015\ufffd\ufffdl\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\u06ac?\ufffdk\u0000\ufffd\u0012\ufffdy\ufffd1p\u0018\ufffd8\ufffd\u0012<\u00177\ufffd\ufffd\r\u43f61",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ\u023a\ufffd\ufffd\u02d1\u000b\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\u0015\ufffd\ufffd\u0014\ufffdZ\"\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0019@\ufffd\u0013<\ufffd*\ufffd\u01b5+\ufffd\\\u0015\ufffd\ufffdl\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "980eb7e641880a73e7ed560ab7b328018befef2a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ\u023a\ufffd\ufffd\u02d1\u000b\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\u0015\ufffd\ufffd\u0014\ufffdZ\"\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0019@\ufffd\u0013<\ufffd*\ufffd\u01b5+\ufffd\\\u0015\ufffd\ufffdl\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9010,
        "service": "discord-webhook",
        "service_label_fr": "Webhook Discord"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdQ\u023a\ufffd\ufffd\u02d1\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\ufffd\ufffd\ufffdZ\"\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd<\ufffd*\ufffd\u01b5+\ufffd\\\ufffd\ufffdl&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
    "target_port_label": "9010 \u00b7 Webhook Discord",
    "emulator_service": "discord-webhook",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Webhook Discord \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "discord-webhook",
        "service_label_fr": "Webhook Discord",
        "dst_port": 9010,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-discord-webhook",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ\u023a\ufffd\ufffd\u02d1\u000b\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\u0015\ufffd\ufffd\u0014\ufffdZ\"\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0019@\ufffd\u0013<\ufffd*\ufffd\u01b5+\ufffd\\\u0015\ufffd\ufffdl\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9010,
            "service": "discord-webhook",
            "service_label_fr": "Webhook Discord"
        },
        "attack_vector": "port scan syn \u00b7 via Webhook Discord:9010 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffdQ\u023a\ufffd\ufffd\u02d1\ufffd|KS\ufffdpVJ\ufffdOK+\ufffd\ufffd\ufffd\ufffdU(b\ufffd\ufffdG_ G\ufffd\ufffd\ufffd\ufffdZ\"\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd<\ufffd*\ufffd\u01b5+\ufffd\\\ufffd\ufffdl&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "9010 \u00b7 Webhook Discord",
        "emulator_service": "discord-webhook",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "discord_webhook",
        "service_banner": "honeypot-discord-webhook",
        "service_os": "linux",
        "dst_port": "9010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 24,
    "port_scan_ports_sample": [
        88,
        554,
        1080,
        2000,
        2376,
        4000,
        4567,
        5001,
        5432,
        5900,
        6001,
        6379,
        7000,
        7474,
        7777,
        8091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 24,
    "scan_velocity_ports_per_s": 25,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "discord_webhook_emulated",
        "net_port_scan_fast",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}