136.112.73.222

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
    "emulator_response_len": 158,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "e76d4f757a9bd2b7b908349144438dc19b9e5bc4",
    "http_host_hash": "b3fecad1903fbad7bf672cc5a25c971b97553846",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 260,
    "payload_entropy": 5.3705397336441765,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 5000,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "dae1c76d0c1d5e1f72f1b08b4a47815dda040ed7",
    "event_fingerprint": "41a5264783b364b03eb66ec4f3aee7e46d71e898",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5b872d7f32c1ae20aba530fff0d900cb",
        "payload_hash": "f69ecccb5a252a34ed5120abd8bb7f2f",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5000,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobile\/16G77 Safari\/604.1",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobile\/16G77 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobile\/16G77 Safari\/604.1",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobile\/16G77 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c2fad73b9f7bbd3a7e592eb4548148124bcf4fdd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobi\u2026",
        "port": 5000,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (",
    "attack_vector": "port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance)",
    "target_port_label": "5000 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobi\u2026",
            "port": 5000,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5000\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (",
        "target_port_label": "5000 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 43.21,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "ac8d6ca0a1e127aabdcbb18abe76f91776646dc5",
    "http_host_hash": "2c876bed771d652f19418bb422c3f95041d35ea3",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 192,
    "payload_entropy": 5.258366961157221,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 5800,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "01d7c22a34771362f081f7380db0480a2aa3e64b",
    "event_fingerprint": "4bea8825aaa1e257e14134fd7145706f6f31ec32",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "70804c27d8f31549abbe90e5b29d2c15",
        "payload_hash": "3d0b2ca6e48962c494073c689ea07fe7",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5800,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAcc",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAcc",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAcc",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "04171002c6d541c65f65672622c3f1d807dc51b2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0",
        "port": 5800,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAcc",
    "attack_vector": "port scan syn \u00b7 via HTTP:5800 \u00b7 (reconnaissance)",
    "target_port_label": "5800 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5800,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0",
            "port": 5800,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:5800 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5800\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; rv:68.0) Gecko\/20100101 Firefox\/68.0\r\nAcc",
        "target_port_label": "5800 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5800"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 42.76,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 202,
    "payload_entropy": 5.24131277128091,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "rtsp",
    "app_proto": "rtsp",
    "asn": 396982,
    "country": "US",
    "dst_port": 554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "602c018427ea7d0638c41cbb6132514c0d6492e5",
    "event_fingerprint": "2b98b50ace92eb4945db6773932d131292c7154f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "rtsp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "09f552837ff7202c202e8ae657b86ebf",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 554,
        "service": "rtsp",
        "service_name": "rtsp",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7595bcfd9fab3e138cd32a6afadaa2c1cd321b27",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
        "port": 554,
        "service": "rtsp",
        "service_label_fr": "RTSP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
    "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
    "target_port_label": "554 \u00b7 RTSP",
    "emulator_service": "rtsp",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "rtsp",
        "service_label_fr": "RTSP",
        "dst_port": 554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
            "port": 554,
            "service": "rtsp",
            "service_label_fr": "RTSP"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko\/20100101 Firefox\/",
        "target_port_label": "554 \u00b7 RTSP",
        "emulator_service": "rtsp",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp",
        "service_banner": "honeypot-rtsp",
        "service_os": "linux",
        "dst_port": "554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 42.66,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "30c85d35bcc7ab0b1eaeb72a3efc055f98e2c5ea",
    "http_host_hash": "d63885d1f1b06da9a39b56d573e583c2216d3a11",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 232,
    "payload_entropy": 5.404365656617558,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 591,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "48dbbb729870e720788969619371864ad287278d",
    "event_fingerprint": "271cc8c619b0ec29df453e90589c718ef2e55875",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4aced8b9c229068deb56f6c937965fa0",
        "payload_hash": "985c974ca2d6167927733d0c58531660",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 591,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko)",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko)",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko)",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "44e7a4efbf5da2eac7f2ef96eb6f8c85e50e9417",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36",
        "port": 591,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko)",
    "attack_vector": "port scan syn \u00b7 via HTTP:591 \u00b7 (reconnaissance)",
    "target_port_label": "591 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 591,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.138 Safari\/537.36",
            "port": 591,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:591 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit\/537.36 (KHTML like Gecko)",
        "target_port_label": "591 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "591"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 42.57,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
    "emulator_response_len": 163,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "da6c5ef166747fadd7336cc2a504329678ff0b2d",
    "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 263,
    "payload_entropy": 5.344999652470557,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 5601,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "469f0d9607d192ae279ce241b2847251709a5652",
    "event_fingerprint": "4bf0bed92220c590c1645b51df7d56d833681f27",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "049c6f681c449a40900175c51eedbe5b",
        "payload_hash": "31de73be7a4bd7c87e7397fd2c30b037",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5601,
        "service": "http",
        "service_name": "http",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebK",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari 525.20.1",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari 525.20.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebK",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari 525.20.1",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.2 Mobile Safari 525.20.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebK",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "980275aeb3108fa9df8249c9ed59cfdc28c8f213",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.\u2026",
        "port": 5601,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebK",
    "attack_vector": "port scan syn \u00b7 via HTTP:5601 \u00b7 (reconnaissance)",
    "target_port_label": "5601 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5601,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebKit\/528.5  (KHTML, like Gecko) Version\/3.1.\u2026",
            "port": 5601,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:5601 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build\/CRB43) AppleWebK",
        "target_port_label": "5601 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5601"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 42.47,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 244,
    "payload_entropy": 5.401718814159915,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 396982,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 52,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1b399fa062d7e9e77dc2fe688f53ca49d3ea92c3",
    "event_fingerprint": "05efda08071dbb20a52cc1b853b9dff0cdf40810",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 52,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a1578c1cea5a112786f32338d16240bc",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "018d8803de2da7f80a6b4ed730f5dbe0e9a83d42",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
    "attack_vector": "port scan syn \u00b7 via COUCHDB:5984 \u00b7 (reconnaissance)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via COUCHDB \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 52,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "port scan syn \u00b7 via COUCHDB:5984 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit\/537.36 (KHTML, like G",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 42.18,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d62911c9f83ec478b13044d93145d49a30d69235",
    "http_host_hash": "0687cd05270085c1f27a6abb15f02e3019988873",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 207,
    "payload_entropy": 5.237915324192623,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 6060,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d1c2cf8563e24f8b10afa0369807c25a709b762c",
    "event_fingerprint": "47987f4db73d6d5111b3d726219ac991e860f156",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "45dd1ad4c406b556a17ef806e9edf4b9",
        "payload_hash": "bc744d90aad3efe6136a76de38ad411b",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6060,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fe",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fe",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fe",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2c1b5a41d91c1c1c1af4005f1f75d205e12210b8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1",
        "port": 6060,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fe",
    "attack_vector": "port scan syn \u00b7 via HTTP:6060 \u00b7 (reconnaissance)",
    "target_port_label": "6060 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6060,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fennec\/2.0.1",
            "port": 6060,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:6060 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6060\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1 Fe",
        "target_port_label": "6060 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6060"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.94,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742078313120726561647920706f72743d363030310d0a",
    "emulator_response_len": 34,
    "bytes_in": 188,
    "payload_entropy": 5.222643702871553,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "x11",
    "app_proto": "x11",
    "asn": 396982,
    "country": "US",
    "dst_port": 6001,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bd8dc4fc1e3164f1b1e1056356dc69d7e3aa96ef",
    "event_fingerprint": "886827acf133d884a34aff45f1821b269ea87703",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "x11",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e369ebbfb591f7560db87505214db7be",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6001,
        "service": "x11",
        "service_name": "x11",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "37a50b90bef5d6d7099bdc2083b38f0108b8c5af",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
        "port": 6001,
        "service": "x11",
        "service_label_fr": "X11"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
    "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
    "target_port_label": "6001 \u00b7 X11",
    "emulator_service": "x11",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "x11",
        "service_label_fr": "X11",
        "dst_port": 6001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-x11",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
            "port": 6001,
            "service": "x11",
            "service_label_fr": "X11"
        },
        "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-",
        "target_port_label": "6001 \u00b7 X11",
        "emulator_service": "x11",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "x11",
        "service_banner": "honeypot-x11",
        "service_os": "linux",
        "dst_port": "6001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.88,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "b746ffea81a2fa3b537e36b4ade1aba43f04765f",
    "http_host_hash": "7ebe258015f7d693a75a6850de5051866e607999",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 239,
    "payload_entropy": 5.397895846725746,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 6080,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "a1827a5f23de23c0a2ad9f5dc1060fa25aa078cd",
    "event_fingerprint": "b3c185c709e45389920543dd89327d4c580f8b22",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bb9f65bd8af7a3b91ac0ca15df58e880",
        "payload_hash": "8f8adab75c14f1d6d49ccde218335c42",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6080,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1680dcc4b582a70778d46c8a379e8e4745ad8078",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36",
        "port": 6080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "attack_vector": "port scan syn \u00b7 via HTTP:6080 \u00b7 (reconnaissance)",
    "target_port_label": "6080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6080,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3880.4 Safari\/537.36",
            "port": 6080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:6080 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6080\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
        "target_port_label": "6080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.78,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "9d8b2fa1599c74e63591442cc4d813329231ea73",
    "http_host_hash": "9d347d028c377ce68c7f996bd692f8cf5d190493",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 200,
    "payload_entropy": 5.277339469083798,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 6000,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac7a599843f5baeee9a9db8e9d532c5ff4727de2",
    "event_fingerprint": "e2298b1a772c2e4c565aaed2f4c19c3d40cdd98a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e18edfb1656e9676e904e728003d5bd4",
        "payload_hash": "e62f34acb113c8b2a384cc84d90f56ad",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6000,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d930768603669133cd47d2086195e664eaed3589",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
        "port": 6000,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/",
    "attack_vector": "port scan syn \u00b7 via HTTP:6000 \u00b7 (reconnaissance)",
    "target_port_label": "6000 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6000,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
            "port": 6000,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:6000 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/",
        "target_port_label": "6000 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.71,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 187,
    "payload_entropy": 5.23740986630526,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 396982,
    "country": "US",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "da3264b523bbcecf1bd1527af07a96789b6f17a8",
    "event_fingerprint": "04d6374d59ed572c37b0bd10ddd9aed46c051187",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 54,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "vnc",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "711891bdae51c646ab35ac45e63b6f36",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 54
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f96f7239bf1aab32e84a8c3fb927b1280218c3ef",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
    "attack_vector": "port scan syn \u00b7 via VNC:5900 \u00b7 (reconnaissance)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via VNC \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 54,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port scan syn \u00b7 via VNC:5900 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-C",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.37,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_flood",
        "vnc_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "e6cec56385f2b2080b6fc4b0558453debf3d5e8f",
    "http_host_hash": "7993cbf68838e7744beb56fab30ddad2438ebd62",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 252,
    "payload_entropy": 5.408278372547208,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 6380,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4ef4e5f75687d676b6748f6c405f7c80a8ca597d",
    "event_fingerprint": "c864a63ca51e46279c3ca502ca03c1b6b4c5539f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "aacde460e32c5ba84404420abe398e82",
        "payload_hash": "507d49ee3b3afd972e0f6a84c4858341",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6380,
        "service": "http",
        "service_name": "http",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3cc18ce21c2c235c91211344cd989fe4504d9e1f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\u2026",
        "port": 6380,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
    "attack_vector": "port scan syn \u00b7 via HTTP:6380 \u00b7 (reconnaissance)",
    "target_port_label": "6380 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6380,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\u2026",
            "port": 6380,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:6380 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6380\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
        "target_port_label": "6380 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6380"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.27,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
    "emulator_response_len": 34,
    "bytes_in": 257,
    "payload_entropy": 5.417588208953921,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "redis",
    "app_proto": "redis",
    "asn": 396982,
    "country": "US",
    "dst_port": 6379,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 56,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "00a0d479d7dc31f324dc3a5340ec6c76410a587d",
    "event_fingerprint": "cb1e6466881216c3bd48182717b6a5f4c8752b29",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 56,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "redis",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dfbd185b8d0fd10bd40e7696f0bf6e79",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6379,
        "service": "redis",
        "service_name": "redis",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0fe9297422768ad610adc13ddd2da3f3f969a3ae",
    "protocol_details": {
        "redis_command_fr": "Sonde protocole Redis",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
        "port": 6379,
        "service": "redis",
        "service_label_fr": "REDIS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
    "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
    "target_port_label": "6379 \u00b7 REDIS",
    "emulator_service": "redis",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 56,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "redis",
        "service_label_fr": "REDIS",
        "dst_port": 6379,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Redis 7.0",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "redis_command_fr": "Sonde protocole Redis",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
            "port": 6379,
            "service": "redis",
            "service_label_fr": "REDIS"
        },
        "attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.",
        "target_port_label": "6379 \u00b7 REDIS",
        "emulator_service": "redis",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "redis",
        "service_banner": "Redis 7.0",
        "service_os": "linux",
        "dst_port": "6379"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 41.2,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_flood",
        "redis_emulated"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
    "emulator_response_len": 165,
    "bytes_in": 195,
    "payload_entropy": 5.3154660711431525,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "k8s-api",
    "app_proto": "k8s-api",
    "asn": 396982,
    "country": "US",
    "dst_port": 6443,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 6.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 57,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "11369eaa6b1cdc9145c3069636b67508100e91f5",
    "event_fingerprint": "96e7f8fdaabc4587a8095c7b4360b2df961365e6",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 57,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "k8s-api",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b67d270a72e686f9550c2306cb5e64a8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 6443,
        "service": "k8s-api",
        "service_name": "k8s-api",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "708955259d8eba9f719f0adfb43d5d08639a9156",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
        "port": 6443,
        "service": "k8s-api",
        "service_label_fr": "K8S API"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
    "attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
    "target_port_label": "6443 \u00b7 K8S API",
    "emulator_service": "k8s-api",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via K8S API \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 57,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "k8s-api",
        "service_label_fr": "K8S API",
        "dst_port": 6443,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-k8s-api",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
            "port": 6443,
            "service": "k8s-api",
            "service_label_fr": "K8S API"
        },
        "attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; DragonFly) KHTML\/4.1.4 (like Gecko)",
        "target_port_label": "6443 \u00b7 K8S API",
        "emulator_service": "k8s-api",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "k8s_api",
        "service_banner": "honeypot-k8s-api",
        "service_os": "linux",
        "dst_port": "6443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.96,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "k8s_api_emulated",
        "k8s_api_payload",
        "kubernetes_probe",
        "mozi_pattern",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "3a25a06c6f39db62e34e7a812c03b23989ac99ad",
    "http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 223,
    "payload_entropy": 5.281416769627102,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 6688,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f3d33af5d79483dc8c3bc833bb83ea36dcb9301b",
    "event_fingerprint": "07c16f749c4e3c43c9136e0959ada622b803d682",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 47,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d0d2d71b2bcefeedd12ef21a2588482a",
        "payload_hash": "b18f90549038c3889eb15a05c54936da",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6688,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/C",
    "method": "GET",
    "path": "\/",
    "user_agent": "SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/C",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/C",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "727381bb06e28a0d07df4add934186347bb64321",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0",
        "port": 6688,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/C",
    "attack_vector": "port scan syn \u00b7 via HTTP:6688 \u00b7 (reconnaissance)",
    "target_port_label": "6688 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 47,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6688,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 UP.Link\/6.3.1.13.0",
            "port": 6688,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:6688 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nUser-Agent: SonyEricssonK310iv\/R4DA Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/C",
        "target_port_label": "6688 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6688"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.79,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "e927dd779001199eaf2d6efd910fcf650cf2b826",
    "http_host_hash": "702e94c6224cba36fec167a8d5985deb195bbdc4",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 239,
    "payload_entropy": 5.3335334794860465,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7007,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "858444bbd831d8ba77596119d5c84d4ca6bf56c0",
    "event_fingerprint": "8b316d646dae29c6f60581a6b78df2f60a6a71cb",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "11475c2e17a7d058b47d1364ed362417",
        "payload_hash": "2d616f3439ed5e881b49f815e3548d54",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7007,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, ",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML,",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML,",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4f35a6d4ced329128ab1f46988d2a7ac4f9f1638",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15",
        "port": 7007,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML,",
    "attack_vector": "port scan syn \u00b7 via HTTP:7007 \u00b7 (reconnaissance)",
    "target_port_label": "7007 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7007,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/11.1.2 Safari\/605.1.15",
            "port": 7007,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:7007 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7007\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/605.1.15 (KHTML,",
        "target_port_label": "7007 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7007"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.49,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "8793643e44c742c7c3494748b04f5af3aeb6f346",
    "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 239,
    "payload_entropy": 5.402415995100039,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ec9e0d0555d79a382d74f2fb85aaa66ec2552b6d",
    "event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 57,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f5b20f13cb0f7e3d9597b6ef1bf377f2",
        "payload_hash": "e07fac2d14709e79ea3b1e38725f9d53",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, li",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, li",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, li",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "300453b8485be2208b64332c39f55588d264bd39",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
        "port": 7001,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, li",
    "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
    "target_port_label": "7001 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 57,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
            "port": 7001,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, li",
        "target_port_label": "7001 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.41,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "c0b1c6fea9e36b2b8989207a63cd7c8313a8d192",
    "http_host_hash": "c00ce26d3a5e014e932dd8f3e8d22128e1d85fff",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 241,
    "payload_entropy": 5.399529026087754,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7002,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.7,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "7c52e9d25b1be5b2daa0664fd61a06883a444e84",
    "event_fingerprint": "1ce1e88e7edb5175a31b6c437449e95fbd4ed9fe",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 57,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "283f8b434eda9742649e36405ad1c821",
        "payload_hash": "567f0208999ccc5e092769244e401b63",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7002,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c43556c1b23714efe27ede6c5877c8a8d60ed5b0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
        "port": 7002,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
    "attack_vector": "port scan syn \u00b7 via HTTP:7002 \u00b7 (reconnaissance)",
    "target_port_label": "7002 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 57,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7002,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
            "port": 7002,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:7002 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7002\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, li",
        "target_port_label": "7002 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.33,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "8b335a7d435b0f64444d1fa11396fd4f69d4a3c4",
    "http_host_hash": "4a103f9100ca9bdcc19e6515fb1d363ff29af5fe",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 244,
    "payload_entropy": 5.40613509079433,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 7008,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "74933fb41b87591ded4a2048439a2edf905008c3",
    "event_fingerprint": "16bd5f4f07c07593c8e437c92e38058c2aed941a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 53,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "1304c67c192c87ad04d86e0c264445bc",
        "payload_hash": "698d9e93b3169d9f6bd9b170a534fc7c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7008,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like ",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfed241500254cb2fcd0420d2326b07d1aa99ff3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/5\u2026",
        "port": 7008,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
    "attack_vector": "port scan syn \u00b7 via HTTP:7008 \u00b7 (reconnaissance)",
    "target_port_label": "7008 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 53,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7008,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/5\u2026",
            "port": 7008,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:7008 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7008\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit\/537.36 (KHTML, like",
        "target_port_label": "7008 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 40.17,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 247,
    "payload_entropy": 5.383712447352901,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "mongodb",
    "app_proto": "mongodb",
    "asn": 396982,
    "country": "US",
    "dst_port": 27017,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 55,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "d23953da38740d81b5222757e40d5d2cff8ef244",
    "event_fingerprint": "791d0656f6abfaa2caa431d7917e16a64b7e912f",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 55,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "mongodb",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b6e5e0520c9865a32875165a34968bcb",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 27017,
        "service": "mongodb",
        "service_name": "mongodb",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15 ",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15  (KHTML, like Gecko) Version\/5.0.3 Safari\/533.19.4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15  (KHTML, like Gecko) Version\/5.0.3 Safari\/533.19.4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "045ebdfd3ef56ab125e016284d446cc70d294198",
    "protocol_details": {
        "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
        "port": 27017,
        "service": "mongodb",
        "service_label_fr": "MONGODB"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
    "attack_vector": "port scan syn \u00b7 via MONGODB:27017 \u00b7 (reconnaissance)",
    "target_port_label": "27017 \u00b7 MONGODB",
    "emulator_service": "mongodb",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MONGODB \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 55,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "mongodb",
        "service_label_fr": "MONGODB",
        "dst_port": 27017,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
            "port": 27017,
            "service": "mongodb",
            "service_label_fr": "MONGODB"
        },
        "attack_vector": "port scan syn \u00b7 via MONGODB:27017 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit\/534.15",
        "target_port_label": "27017 \u00b7 MONGODB",
        "emulator_service": "mongodb",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb",
        "service_banner": "honeypot-mongodb",
        "service_os": "linux",
        "dst_port": "27017"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 39.1,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mongodb_emulated",
        "mongodb_wire_protocol",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.79132653397925,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 43,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d4ad2941aa96594e2fed8b74e01bfec12ade6278",
    "event_fingerprint": "2469b8b21b6c3f1c7e3cafae5189bb84f3c191eb",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 43,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "74a65b70831446abe8c09652d881fcae",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8400,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 43
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000b\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\u001d\ufffd\ufffd_{\ufffd\u0014\/\\\ufffd\u056df-\ufffd\u0013\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\u0019\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\u0006\ufffd\ubceb\u0010Bw\ufffd:\u001d_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000b\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\u001d\ufffd\ufffd_{\ufffd\u0014\/\\\ufffd\u056df-\ufffd\u0013\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\u0019\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\u0006\ufffd\ubceb\u0010Bw\ufffd:\u001d_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 D\ufffd\u0003pMs\ufffd\tb\ufffd\ufffdN\u029a5\ufffdBu$\ufffd\u017dr\u0001\u0019H0?9\u001ei",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000b\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\u001d\ufffd\ufffd_{\ufffd\u0014\/\\\ufffd\u056df-\ufffd\u0013\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\u0019\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\u0006\ufffd\ubceb\u0010Bw\ufffd:\u001d_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7f2a2458fd999e103d3c59fa6acd457ada3433be",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000b\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\u001d\ufffd\ufffd_{\ufffd\u0014\/\\\ufffd\u056df-\ufffd\u0013\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\u0019\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\u0006\ufffd\ubceb\u0010Bw\ufffd:\u001d_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8400,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\ufffd\ufffd_{\ufffd\/\\\ufffd\u056df-\ufffd\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd\ubcebBw\ufffd:_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8400 \u00b7 (reconnaissance)",
    "target_port_label": "8400 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 43,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8400,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000b\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\u001d\ufffd\ufffd_{\ufffd\u0014\/\\\ufffd\u056df-\ufffd\u0013\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\u0019\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\u0006\ufffd\ubceb\u0010Bw\ufffd:\u001d_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8400,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8400 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\r\ufffd\ufffd&\ufffd[<\ufffd\ufffd_{\ufffd\/\\\ufffd\u056df-\ufffd\ufffd \ufffd\ufffd\ufffd{9\ufffd\u067b\ufffd_IDv\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd\ubcebBw\ufffd:_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8400 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.98,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.844505847447211,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8383,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "fe7a6640176c4556cae27e5041b79ddcfa3ae362",
    "event_fingerprint": "96e1d8bd30b7769821240937e79583d079f8c26e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "243ff3a08a956a08d06dd50130b4243b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8383,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\u001e\ufffd\u0019\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\u0005\ufffd\ufffd\u0019\ufffd\u0007\ufffd\ufffd\ufffd\ufffd&g P\ufffd\u0000\ufffd\u0002\ufffdj\ufffdc\ufffd\u0001\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\u001b\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\u001e\ufffd\u0019\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\u0005\ufffd\ufffd\u0019\ufffd\u0007\ufffd\ufffd\ufffd\ufffd&g P\ufffd\u0000\ufffd\u0002\ufffdj\ufffdc\ufffd\u0001\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\u001b\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd4\ufffd&\u0010\u001f\ufffd\u0001\ufffd0\ufffd\ufffd\ufffd\u05beoE\t\u000e\ufffdY\ufffdt\ufffd\ufffd\ufffd\ufffd\u00110\ufffd\ufffdR",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\u001e\ufffd\u0019\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\u0005\ufffd\ufffd\u0019\ufffd\u0007\ufffd\ufffd\ufffd\ufffd&g P\ufffd\u0000\ufffd\u0002\ufffdj\ufffdc\ufffd\u0001\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\u001b\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6361e315b973c2ba2d10be6ac39432edf943176",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\u001e\ufffd\u0019\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\u0005\ufffd\ufffd\u0019\ufffd\u0007\ufffd\ufffd\ufffd\ufffd&g P\ufffd\u0000\ufffd\u0002\ufffdj\ufffdc\ufffd\u0001\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\u001b\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8383,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd;\ufffd\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&g P\ufffd\ufffd\ufffdj\ufffdc\ufffd\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\/&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8383 \u00b7 (reconnaissance)",
    "target_port_label": "8383 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8383,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;\u001e\ufffd\u0019\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\u0005\ufffd\ufffd\u0019\ufffd\u0007\ufffd\ufffd\ufffd\ufffd&g P\ufffd\u0000\ufffd\u0002\ufffdj\ufffdc\ufffd\u0001\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\u001b\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8383,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8383 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd;\ufffd\ufffd!\r\ufffdi1\ufffd\ufffd.OSw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&g P\ufffd\ufffd\ufffdj\ufffdc\ufffd\ufffdu{[\ufffd>v\ufffd(\ufffd{\ufffdY@\ufffdr\ufffd\/&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8383 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8383"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.82,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.819189695975849,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 396982,
    "country": "US",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "602ecc7984feae22664230a9fc6b61e756fd9f12",
    "event_fingerprint": "1268b50d410d1cdd8232ddd7c8594924aae881d7",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ebead3ce395796dc44f725a762728381",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\u001d\u0018\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\b\u0014\ufffd\ufffd\ufffd0\u000f ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffd\u0012T\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\u0010\ufffdV\u001a\u000e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\u001d\u0018\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\b\u0014\ufffd\ufffd\ufffd0\u000f ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffd\u0012T\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\u0010\ufffdV\u001a\u000e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdL\ufffd\ufffdb\u001c \u00070\ufffd\ufffd\ufffdWpA4\ufffd\ufffd\ufffd\u0235\u0221\ufffd\ufffd\ufffd0\ufffd\u0001\ufffd\ufffd\b",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\u001d\u0018\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\b\u0014\ufffd\ufffd\ufffd0\u000f ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffd\u0012T\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\u0010\ufffdV\u001a\u000e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "091d5e2805471f39e4692cc8fcf5fac81fe25736",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\u001d\u0018\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\b\u0014\ufffd\ufffd\ufffd0\u000f ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffd\u0012T\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\u0010\ufffdV\u001a\u000e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "\ufffd\ufffd3P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\ufffd\ufffd\ufffd0 ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffdT\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\ufffdV&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\u001d\u0018\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\b\u0014\ufffd\ufffd\ufffd0\u000f ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffd\u0012T\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\u0010\ufffdV\u001a\u000e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd3P\ufffdn\r\ufffd|\ufffd)qE\u050a\ufffd\ufffd&\ufffd\ufffd\nl\ufffd\ufffd\ufffd\ufffd\ufffd0 ^\ufffd`\ufffd?,\ufffd\ufffd\ufffd\ufffd=I\ufffd\ufffdT\ufffdh\ufffd{\ufffdq\ufffd\ufffd\ufffd\ufffdV&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.63,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 239,
    "payload_entropy": 5.8647821518429595,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "postgres",
    "app_proto": "postgres",
    "asn": 396982,
    "country": "US",
    "dst_port": 5432,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "0fa725289939db6d9ad9a968d34b4c38badd02c7",
    "event_fingerprint": "94c4cbfb85d1c35e2f48ce388a5c59a6c911d001",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "postgres",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "68438f899bb4e658b49e781325d336e7",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5432,
        "service": "postgres",
        "service_name": "postgres",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\b4\u0006G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\u000e\ufffd\u001cam\u000e\ufffdq\ufffd:\ufffd5 \u001f\u0015k\u0006b\u001d_\u0015Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\u001e\"\u000f\ufffd\ufffd\u001d)\ufffd\ufffd\u001f\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\b4\u0006G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\u000e\ufffd\u001cam\u000e\ufffdq\ufffd:\ufffd5 \u001f\u0015k\u0006b\u001d_\u0015Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\u001e\"\u000f\ufffd\ufffd\u001d)\ufffd\ufffd\u001f\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 eA\u0001qu\ufffd\u0016\ufffdB\ufffdh\t\ufffd{\ufffdE~v\u0013\ufffd\u0737\ufffd\ufffd`\ufffd\ufffd\u0235\ufffd\u0002v",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\b4\u0006G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\u000e\ufffd\u001cam\u000e\ufffdq\ufffd:\ufffd5 \u001f\u0015k\u0006b\u001d_\u0015Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\u001e\"\u000f\ufffd\ufffd\u001d)\ufffd\ufffd\u001f\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e8d302e9be72fd2327ca5c7cc229715ed89a5e8e",
    "protocol_details": {
        "postgres_startup_fr": "Handshake PostgreSQL (startup)",
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\b4\u0006G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\u000e\ufffd\u001cam\u000e\ufffdq\ufffd:\ufffd5 \u001f\u0015k\u0006b\u001d_\u0015Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\u001e\"\u000f\ufffd\ufffd\u001d)\ufffd\ufffd\u001f\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 5432,
        "service": "postgres",
        "service_label_fr": "POSTGRES"
    },
    "evidence_snippet": "\ufffd\ufffd.\ufffd4G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\ufffdam\ufffdq\ufffd:\ufffd5 kb_Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\"\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\"&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
    "target_port_label": "5432 \u00b7 POSTGRES",
    "emulator_service": "postgres",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via POSTGRES \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "postgres",
        "service_label_fr": "POSTGRES",
        "dst_port": 5432,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "PostgreSQL 15.4",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "postgres_startup_fr": "Handshake PostgreSQL (startup)",
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\b4\u0006G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\u000e\ufffd\u001cam\u000e\ufffdq\ufffd:\ufffd5 \u001f\u0015k\u0006b\u001d_\u0015Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\u001e\"\u000f\ufffd\ufffd\u001d)\ufffd\ufffd\u001f\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 5432,
            "service": "postgres",
            "service_label_fr": "POSTGRES"
        },
        "attack_vector": "port scan syn \u00b7 via POSTGRES:5432 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd.\ufffd4G\ufffdsH\ufffdf\ufffd\u015a\ufffd\ufffdN>at\ufffdam\ufffdq\ufffd:\ufffd5 kb_Q\ufffd\ufffd\ufffdkE\ufffd\ufffdM>-\"\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\"&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "5432 \u00b7 POSTGRES",
        "emulator_service": "postgres",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "postgres",
        "service_banner": "PostgreSQL 15.4",
        "service_os": "linux",
        "dst_port": "5432"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.43,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "postgres_emulated",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.854091120203027,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8447,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "171007aeeebeccc012a3c0d8a5f86489dc657c12",
    "event_fingerprint": "2908933e9b69c5b57d74cf281cae54e81e2aaa46",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5e235d78ab44d198158fa2a54151b0e7",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8447,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdum\ufffd\ufffd\u00197\t\ufffd\ufffd\ufffd\ufffd\ufffd\u0013C\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \u0015\/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdG\u0016H\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdum\ufffd\ufffd\u00197\t\ufffd\ufffd\ufffd\ufffd\ufffd\u0013C\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \u0015\/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdG\u0016H\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 E\u053e\u0001\ufffd\ufffdYY\ua455\u0010\u001a\ufffd\ufffd\"Zv\ufffdt\u0013\ufffd\ufffd\u0007\u001c\ufffd\ufffd\ufffd-J",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdum\ufffd\ufffd\u00197\t\ufffd\ufffd\ufffd\ufffd\ufffd\u0013C\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \u0015\/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdG\u0016H\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1d083fd25e0c89a3fa182bdfbb3adaa64d8fc2f0",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdum\ufffd\ufffd\u00197\t\ufffd\ufffd\ufffd\ufffd\ufffd\u0013C\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \u0015\/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdG\u0016H\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8447,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdum\ufffd\ufffd7\t\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdGH\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8447 \u00b7 (reconnaissance)",
    "target_port_label": "8447 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8447,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdum\ufffd\ufffd\u00197\t\ufffd\ufffd\ufffd\ufffd\ufffd\u0013C\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \u0015\/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdG\u0016H\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8447,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8447 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdum\ufffd\ufffd7\t\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffdQ\ufffdO\ufffd.n9\ufffd8\u03a3\ufffd\ufffd\ufffd \/X\ufffd\ufffd\u0702&\ufffd\ufffd\ufffdk\ufffd\ufffdGH\ufffdn\ufffdY\ufffd\ufffd\ufffd\ufffd\r\ufffd\/\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8447 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8447"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.24,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.831859758055499,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 84,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c58469956f64e11baffda813bc699149362b0142",
    "event_fingerprint": "9d5685972cb108baef265e7584fee5997a32fb8e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ad542dc43e1a1fd245354304736738d5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 84,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[3\u001ex\ufffd\ufffdD\ufffd\fb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2\u0002 \ufffd6}H\ufffd\u0013\ufffd\u0013\ufffdL\ufffd>\ufffd\u01ac\u001f\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[3\u001ex\ufffd\ufffdD\ufffd\fb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2\u0002 \ufffd6}H\ufffd\u0013\ufffd\u0013\ufffdL\ufffd>\ufffd\u01ac\u001f\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u00af\ufffd\ufffd\ufffdZ\u001e\"\ufffdr\ufffd\t\ufffd\ufffdw\u0014-)\ufffd_\ufffd%#\ufffd`\ufffd[\u063e\u001c\u0007\r",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[3\u001ex\ufffd\ufffdD\ufffd\fb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2\u0002 \ufffd6}H\ufffd\u0013\ufffd\u0013\ufffdL\ufffd>\ufffd\u01ac\u001f\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fdd1b017638f0e80ff9b2ee576e80bac665d1ecf",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[3\u001ex\ufffd\ufffdD\ufffd\fb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2\u0002 \ufffd6}H\ufffd\u0013\ufffd\u0013\ufffdL\ufffd>\ufffd\u01ac\u001f\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 84,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd[3x\ufffd\ufffdD\ufffdb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2 \ufffd6}H\ufffd\ufffd\ufffdL\ufffd>\ufffd\u01ac\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:84 \u00b7 (reconnaissance)",
    "target_port_label": "84 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 84,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[3\u001ex\ufffd\ufffdD\ufffd\fb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2\u0002 \ufffd6}H\ufffd\u0013\ufffd\u0013\ufffdL\ufffd>\ufffd\u01ac\u001f\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 84,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:84 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd[3x\ufffd\ufffdD\ufffdb{\ufffd\ufffd\u060c|Z`\ufffd%%\ufffd&\ufffd\u0593\ufffd\ufffd\u8ef2 \ufffd6}H\ufffd\ufffd\ufffdL\ufffd>\ufffd\u01ac\ufffdo\ufffd\ufffdO\ufffdC\r]\ufffdhP\n\ufffd\r\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "84 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "84"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 58.07,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.834463441766642,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9b0a717d7354010ba603893605531024",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8445,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000b\u001d\ufffdC\ufffdEvY\ufffd\fqV\u0690\ufffd\ufffd\ufffd\u0006e}\ufffd\u0014_|7\u0019\ufffd\ufffd \rw!W\u02de\ufffd\ufffd\u000e5\b\ufffdj\ufffd\u001e1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000b\u001d\ufffdC\ufffdEvY\ufffd\fqV\u0690\ufffd\ufffd\ufffd\u0006e}\ufffd\u0014_|7\u0019\ufffd\ufffd \rw!W\u02de\ufffd\ufffd\u000e5\b\ufffdj\ufffd\u001e1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010\u069e88\ufffdZb\ufffd\ufffd\ufffd\ufffdw\ufffd\u0005\ufffd*B-{U\ufffdH\ufffdUq\u0012a\ufffd\ufffdC",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000b\u001d\ufffdC\ufffdEvY\ufffd\fqV\u0690\ufffd\ufffd\ufffd\u0006e}\ufffd\u0014_|7\u0019\ufffd\ufffd \rw!W\u02de\ufffd\ufffd\u000e5\b\ufffdj\ufffd\u001e1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed92616a23d40ac6116a63df50a305053ca97ecf",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000b\u001d\ufffdC\ufffdEvY\ufffd\fqV\u0690\ufffd\ufffd\ufffd\u0006e}\ufffd\u0014_|7\u0019\ufffd\ufffd \rw!W\u02de\ufffd\ufffd\u000e5\b\ufffdj\ufffd\u001e1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8445,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffdEvY\ufffdqV\u0690\ufffd\ufffd\ufffde}\ufffd_|7\ufffd\ufffd \rw!W\u02de\ufffd\ufffd5\ufffdj\ufffd1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8445 \u00b7 (reconnaissance)",
    "target_port_label": "8445 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8445,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000b\u001d\ufffdC\ufffdEvY\ufffd\fqV\u0690\ufffd\ufffd\ufffd\u0006e}\ufffd\u0014_|7\u0019\ufffd\ufffd \rw!W\u02de\ufffd\ufffd\u000e5\b\ufffdj\ufffd\u001e1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8445,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8445 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffdEvY\ufffdqV\u0690\ufffd\ufffd\ufffde}\ufffd_|7\ufffd\ufffd \rw!W\u02de\ufffd\ufffd5\ufffdj\ufffd1K\ufffdjF\ufffd\/\ufffd\ufffd\/Xz\ufffd\u3631~&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8445 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8445"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 57.91,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.936690234676812,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8484,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c2c792a3ac1aea10eb5775962ea800ba8d02a465",
    "event_fingerprint": "d46b8517b81aae876f4a79994a9b80a4f9c925ac",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "0d42fd3e43304a30549b134249aa7a49",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8484,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd3\ufffd\u0013\ufffd\ufffd:\fj\ufffd!\ufffd\u000e11\ufffd\ufffd\ufffd\ufffd\ufffd\u000fR\ufffd\u000b\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'\u0014a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd3\ufffd\u0013\ufffd\ufffd:\fj\ufffd!\ufffd\u000e11\ufffd\ufffd\ufffd\ufffd\ufffd\u000fR\ufffd\u000b\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'\u0014a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001b\ufffd\ufffd\ufffd\ufffdR{B\u001e]\u0012.k\ufffd\ufffd-M\u0012\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd2\ufffd\u000bA#4r",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd3\ufffd\u0013\ufffd\ufffd:\fj\ufffd!\ufffd\u000e11\ufffd\ufffd\ufffd\ufffd\ufffd\u000fR\ufffd\u000b\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'\u0014a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "616d6196ab7f6c505ba69bddaf2b0a4d9d202274",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd3\ufffd\u0013\ufffd\ufffd:\fj\ufffd!\ufffd\u000e11\ufffd\ufffd\ufffd\ufffd\ufffd\u000fR\ufffd\u000b\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'\u0014a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8484,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd:j\ufffd!\ufffd11\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8484 \u00b7 (reconnaissance)",
    "target_port_label": "8484 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8484,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd3\ufffd\u0013\ufffd\ufffd:\fj\ufffd!\ufffd\u000e11\ufffd\ufffd\ufffd\ufffd\ufffd\u000fR\ufffd\u000b\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'\u0014a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8484,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8484 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd:j\ufffd!\ufffd11\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd07\u0279\u04fe& n\ufffd|\ufffdE'a\ufffd\ufffdX_-\ufffdV\ufffd\ufffd\u02fc\ufffd\ufffd\ufffd\u04a0\ufffd\ufffdpE\ufffd`&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8484 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8484"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 57.75,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.856234439749368,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 85,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4df91f7293d25e8dffcc2a58484081faec58e554",
    "event_fingerprint": "754334eea77e152194af1c8406d53142646fc6e6",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "db84bd8aba67bb43aed239f4002fa020",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 85,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\u001b\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\u0014\u0001\ufffd\u0017 JAZ.\ufffd\ufffdvd\ufffdA\ufffd\u0004T\ufffd\ufffd<\u0136\u0015\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\u0015\nk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\u001b\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\u0014\u0001\ufffd\u0017 JAZ.\ufffd\ufffdvd\ufffdA\ufffd\u0004T\ufffd\ufffd<\u0136\u0015\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\u0015\nk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd|\ufffd\ufffd`\u0016\ufffdL\u0011X\ufffd0\ufffd\b\uacae5&>$\ufffd\ufffd\ufffd\u0249\ufffdvM\ufffd\u000f",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\u001b\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\u0014\u0001\ufffd\u0017 JAZ.\ufffd\ufffdvd\ufffdA\ufffd\u0004T\ufffd\ufffd<\u0136\u0015\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\u0015\nk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "092ba3320285d69d601ef0b69a403a5490f69957",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\u001b\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\u0014\u0001\ufffd\u0017 JAZ.\ufffd\ufffdvd\ufffdA\ufffd\u0004T\ufffd\ufffd<\u0136\u0015\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\u0015\nk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 85,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\ufffd JAZ.\ufffd\ufffdvd\ufffdA\ufffdT\ufffd\ufffd<\u0136\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\nk&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:85 \u00b7 (reconnaissance)",
    "target_port_label": "85 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\u001b\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\u0014\u0001\ufffd\u0017 JAZ.\ufffd\ufffdvd\ufffdA\ufffd\u0004T\ufffd\ufffd<\u0136\u0015\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\u0015\nk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 85,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:85 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd^\n9g\ufffd\ufffdD\ufffdd1\ufffd JAZ.\ufffd\ufffdvd\ufffdA\ufffdT\ufffd\ufffd<\u0136\ufffd<\ufffd\ufffd\ufffd\u0292\ufffd\ufffd\nk&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "85 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 57.61,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.859572476119798,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8448,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "46561329e057ddcd39e341b83bd7317f758634e7",
    "event_fingerprint": "43054e981ac88edf8c2872bf03242255b30517bd",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3b2d64f6043f50ab8447e1a5088b76ee",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8448,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd\f\u0018$!-\u0017P\ufffd\u0001`8\ufffd5H\ufffd\u001e* O\ufffd\ufffdV\ufffdo\/\ufffd\u000e^\ufffd;\u001fm\ufffd*\ufffd\ufffd\u001aP\ufffd\u001c\ufffdN\u0004)\ufffd\u0016Z\ufffd!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd\f\u0018$!-\u0017P\ufffd\u0001`8\ufffd5H\ufffd\u001e* O\ufffd\ufffdV\ufffdo\/\ufffd\u000e^\ufffd;\u001fm\ufffd*\ufffd\ufffd\u001aP\ufffd\u001c\ufffdN\u0004)\ufffd\u0016Z\ufffd!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0013S\ufffd4\u001b\u0010>\ufffd\ufffd\ufffd\u00ac\ufffdq\ufffd\ufffd8\ufffdo\ufffds\u0012\u03f3\u000e\ufffd\ufffd\ufffdJ\ufffdbj",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd\f\u0018$!-\u0017P\ufffd\u0001`8\ufffd5H\ufffd\u001e* O\ufffd\ufffdV\ufffdo\/\ufffd\u000e^\ufffd;\u001fm\ufffd*\ufffd\ufffd\u001aP\ufffd\u001c\ufffdN\u0004)\ufffd\u0016Z\ufffd!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9a0a17451e8530b6d230d621b67fc4070b3b486c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd\f\u0018$!-\u0017P\ufffd\u0001`8\ufffd5H\ufffd\u001e* O\ufffd\ufffdV\ufffdo\/\ufffd\u000e^\ufffd;\u001fm\ufffd*\ufffd\ufffd\u001aP\ufffd\u001c\ufffdN\u0004)\ufffd\u0016Z\ufffd!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8448,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdWy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd$!-P\ufffd`8\ufffd5H\ufffd* O\ufffd\ufffdV\ufffdo\/\ufffd^\ufffd;m\ufffd*\ufffd\ufffdP\ufffd\ufffdN)\ufffdZ\ufffd!\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8448 \u00b7 (reconnaissance)",
    "target_port_label": "8448 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8448,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd\f\u0018$!-\u0017P\ufffd\u0001`8\ufffd5H\ufffd\u001e* O\ufffd\ufffdV\ufffdo\/\ufffd\u000e^\ufffd;\u001fm\ufffd*\ufffd\ufffd\u001aP\ufffd\u001c\ufffdN\u0004)\ufffd\u0016Z\ufffd!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8448,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8448 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdWy Q\u04e2,\ufffdfw\ufffd`\ufffdY\ufffd$!-P\ufffd`8\ufffd5H\ufffd* O\ufffd\ufffdV\ufffdo\/\ufffd^\ufffd;m\ufffd*\ufffd\ufffdP\ufffd\ufffdN)\ufffdZ\ufffd!\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8448 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8448"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 57.45,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.803967683606487,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "consul-wan",
    "app_proto": "consul-wan",
    "asn": 396982,
    "country": "US",
    "dst_port": 8501,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "eed78204128a8aea3ed7d7f226954e849f5ffb37",
    "event_fingerprint": "4ad7a9a835dbe72737095a292340d33149ef485e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "consul-wan",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b54e1be202e1df1d13f04b7af2787460",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8501,
        "service": "consul-wan",
        "service_name": "consul-wan",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffd\u0012L[\ufffdw\ufffdg\u0016\u0012HC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffd\u0019n\/\ufffd?Qo\u0003\ufffdT\ufffdC\ufffd\ufffd\u0002B\ufffd\u0011Y\f\ufffd0\ufffd\u0014\u0018\u0005\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffd\u0012L[\ufffdw\ufffdg\u0016\u0012HC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffd\u0019n\/\ufffd?Qo\u0003\ufffdT\ufffdC\ufffd\ufffd\u0002B\ufffd\u0011Y\f\ufffd0\ufffd\u0014\u0018\u0005\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0013\ufffd\ufffd\ufffd\ufffd<m}m\ufffdF^\u0005\u00040\ufffd\u0011-\ufffd\ufffd'\ufffd\ufffdR\ufffd\ufffdW>\ufffd\/:",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffd\u0012L[\ufffdw\ufffdg\u0016\u0012HC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffd\u0019n\/\ufffd?Qo\u0003\ufffdT\ufffdC\ufffd\ufffd\u0002B\ufffd\u0011Y\f\ufffd0\ufffd\u0014\u0018\u0005\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a45824b71cc4b175e179c7b7f73f4d0fa4d81fb9",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffd\u0012L[\ufffdw\ufffdg\u0016\u0012HC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffd\u0019n\/\ufffd?Qo\u0003\ufffdT\ufffdC\ufffd\ufffd\u0002B\ufffd\u0011Y\f\ufffd0\ufffd\u0014\u0018\u0005\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8501,
        "service": "consul-wan",
        "service_label_fr": "CONSUL WAN"
    },
    "evidence_snippet": "\ufffd\ufffd,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffdL[\ufffdw\ufffdgHC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffdn\/\ufffd?Qo\ufffdT\ufffdC\ufffd\ufffdB\ufffdY\ufffd0\ufffd\ufffd\ufffdn&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via CONSUL WAN:8501 \u00b7 (reconnaissance)",
    "target_port_label": "8501 \u00b7 CONSUL WAN",
    "emulator_service": "consul-wan",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CONSUL WAN \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "consul-wan",
        "service_label_fr": "CONSUL WAN",
        "dst_port": 8501,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-consul-wan",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffd\u0012L[\ufffdw\ufffdg\u0016\u0012HC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffd\u0019n\/\ufffd?Qo\u0003\ufffdT\ufffdC\ufffd\ufffd\u0002B\ufffd\u0011Y\f\ufffd0\ufffd\u0014\u0018\u0005\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8501,
            "service": "consul-wan",
            "service_label_fr": "CONSUL WAN"
        },
        "attack_vector": "port scan syn \u00b7 via CONSUL WAN:8501 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd,\ufffdn\ufffd\ufffd\ufffd\u0763i\ufffdL[\ufffdw\ufffdgHC\u0449\ufffd\ufffd\ufffdN\ufffd\ufffd43 ]\ufffd\ufffdn\/\ufffd?Qo\ufffdT\ufffdC\ufffd\ufffdB\ufffdY\ufffd0\ufffd\ufffd\ufffdn&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8501 \u00b7 CONSUL WAN",
        "emulator_service": "consul-wan",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "consul_wan",
        "service_banner": "honeypot-consul-wan",
        "service_os": "linux",
        "dst_port": "8501"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 57.07,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "consul_probe",
        "consul_wan_emulated",
        "consul_wan_payload",
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.851707890862629,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8600,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "80b9e73db9e0a9664041a26b64552dc4d5b113bf",
    "event_fingerprint": "557df0313435709dcb4d7282154d3f9fc595a068",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "601ca4b320959a78ebfe179d1479b1c6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8600,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?\u001aQ\ufffdRS\ufffd\u001a\t\ufffd\u0016\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.\u0003;\u0017\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\u001b\u0012\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?\u001aQ\ufffdRS\ufffd\u001a\t\ufffd\u0016\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.\u0003;\u0017\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\u001b\u0012\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdY2%\ufffd\ufffd;\ufffd\ufffd\ufffd9s\ufffdWo\ufffd1\ufffd\ufffd\u0018X\ufffd\ufffd4\ufffd~\ufffd\t\\\u0018d",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?\u001aQ\ufffdRS\ufffd\u001a\t\ufffd\u0016\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.\u0003;\u0017\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\u001b\u0012\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0e94a810b88de23cad42c645e0950c80c6e5853a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?\u001aQ\ufffdRS\ufffd\u001a\t\ufffd\u0016\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.\u0003;\u0017\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\u001b\u0012\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8600,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?Q\ufffdRS\ufffd\t\ufffd\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.;\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8600 \u00b7 (reconnaissance)",
    "target_port_label": "8600 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8600,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd?\u001aQ\ufffdRS\ufffd\u001a\t\ufffd\u0016\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.\u0003;\u0017\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\u001b\u0012\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8600,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8600 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?Q\ufffdRS\ufffd\t\ufffd\ufffd\u048b\ufffdX\ufffd\ufffd\u038c.;\ufffd\ufffd\ufffd#\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd09Q\ufffd\t,\ufffd\ufffdrH\ufffd\ufffd\ufffdz\ufffdE\ufffd&\ufffdn\ufffd\ufffd0\ufffd\u03d3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8600 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8600"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 56.8,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8550706751473705,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8900,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "7a5fc9bc631b6de7d8cfdd83fe2ff5a965bc0c09",
    "event_fingerprint": "e30a9abcc1bdf1f6f46eec815d2060267bc72ced",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f241ff95ddd53b25f94a4d4299535bed",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8900,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r2g\ufffdTy4\ufffd\u0000!\ufffd\ufffd\ufffdP\u035f\ufffd\u001fv\ufffd\ufffd\u0305F\u0017\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\u000e\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\b\u000b\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r2g\ufffdTy4\ufffd\u0000!\ufffd\ufffd\ufffdP\u035f\ufffd\u001fv\ufffd\ufffd\u0305F\u0017\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\u000e\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\b\u000b\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001b+\ufffd^\ufffd\ufffd:,\ufffd\ufffd\ufffd-k<\ufffd\ufffda\ufffdzQ\ufffd2\ufffd\ufffd\ufffdhr\ufffd@",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r2g\ufffdTy4\ufffd\u0000!\ufffd\ufffd\ufffdP\u035f\ufffd\u001fv\ufffd\ufffd\u0305F\u0017\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\u000e\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\b\u000b\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fd93985354265c10477bbbd9d52b2717809163ab",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r2g\ufffdTy4\ufffd\u0000!\ufffd\ufffd\ufffdP\u035f\ufffd\u001fv\ufffd\ufffd\u0305F\u0017\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\u000e\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\b\u000b\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8900,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdr2g\ufffdTy4\ufffd!\ufffd\ufffd\ufffdP\u035f\ufffdv\ufffd\ufffd\u0305F\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8900 \u00b7 (reconnaissance)",
    "target_port_label": "8900 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8900,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r2g\ufffdTy4\ufffd\u0000!\ufffd\ufffd\ufffdP\u035f\ufffd\u001fv\ufffd\ufffd\u0305F\u0017\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\u000e\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\b\u000b\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8900,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8900 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdr2g\ufffdTy4\ufffd!\ufffd\ufffd\ufffdP\u035f\ufffdv\ufffd\ufffd\u0305F\ufffdD#\ufffdA}\ufffd j\ufffd\ufffdS\ufffd\ufffd\t\ufffd\ufffd\ufffd00,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u32f2\u02f6T\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8900 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 56.65,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.91368658957521,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8880",
    "app_proto": "http-alt-8880",
    "asn": 396982,
    "country": "US",
    "dst_port": 8880,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "2522c2f6472f99c7b02df501cf842b19f28fdc2d",
    "event_fingerprint": "e107c665192be8de8ff787df5048c9acd313d9bd",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8880",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e966c98c5f073b156c0d2c5e963caece",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8880,
        "service": "http-alt-8880",
        "service_name": "http-alt-8880",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\u0005\ufffd_\u0003wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd\f\u001a3\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\u0005\ufffd_\u0003wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd\f\u001a3\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\/>\ufffd\u00168\ufffd\ufffd\u077b\ufffd\ufffd\ufffd\u001dGTq\ufffd\ufffd\ufffde\ufffd_\ufffd\u000b\ufffdc\ufffd^\ufffdPA",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\u0005\ufffd_\u0003wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd\f\u001a3\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "470737d85fd84e80445c0051e1901a05540b1af3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\u0005\ufffd_\u0003wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd\f\u001a3\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8880,
        "service": "http-alt-8880",
        "service_label_fr": "HTTP ALT 8880"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\ufffd_wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd3\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via HTTP ALT 8880:8880 \u00b7 (reconnaissance)",
    "target_port_label": "8880 \u00b7 HTTP ALT 8880",
    "emulator_service": "http-alt-8880",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8880 \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http-alt-8880",
        "service_label_fr": "HTTP ALT 8880",
        "dst_port": 8880,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8880",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\u0005\ufffd_\u0003wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd\f\u001a3\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8880,
            "service": "http-alt-8880",
            "service_label_fr": "HTTP ALT 8880"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP ALT 8880:8880 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdK\ufffdPV\ufffd\ufffdWw\ufffdt\ufffd\ufffd\ufffd\ufffd_wlF\u00d7D\ufffd|hU C\ufffdon\ufffd2*\ufffd\ufffd\r\ufffd(]\ufffd\ufffd\ufffd\ufffd\u05c8U\ufffd\ufffd\ufffd\ufffd'\ufffd3\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8880 \u00b7 HTTP ALT 8880",
        "emulator_service": "http-alt-8880",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8880",
        "service_banner": "honeypot-http-alt-8880",
        "service_os": "linux",
        "dst_port": "8880"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 56.48,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.797019198239722,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "0e68e0be046c3406c193942a59fdb53f03d80944",
    "event_fingerprint": "9089df7f6e0d6a703785ea70af8d3ad814386c24",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "64c0839d3044dfeacf134fd874f4a728",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc`\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u001c\u0013\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\u0012\u0016\ufffdn\u045369\ufffdA\f\f#-\ufffd\ufffdCr\ufffdTc\n^\u0000\ufffd\u0015U\ufffd\ufffdi\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc`\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u001c\u0013\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\u0012\u0016\ufffdn\u045369\ufffdA\f\f#-\ufffd\ufffdCr\ufffdTc\n^\u0000\ufffd\u0015U\ufffd\ufffdi\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdI\ufffd\ufffd@\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\u0011\ufffd\ufffd\b\ufffd$\u0004\ufffd9\u06248-\u00129",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc`\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u001c\u0013\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\u0012\u0016\ufffdn\u045369\ufffdA\f\f#-\ufffd\ufffdCr\ufffdTc\n^\u0000\ufffd\u0015U\ufffd\ufffdi\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f4a32a05fe7c92934a78e5385eb414341a4d6988",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc`\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u001c\u0013\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\u0012\u0016\ufffdn\u045369\ufffdA\f\f#-\ufffd\ufffdCr\ufffdTc\n^\u0000\ufffd\u0015U\ufffd\ufffdi\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdc`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\ufffdn\u045369\ufffdA#-\ufffd\ufffdCr\ufffdTc\n^\ufffdU\ufffd\ufffdi&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8898 \u00b7 (reconnaissance)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdc`\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u001c\u0013\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\u0012\u0016\ufffdn\u045369\ufffdA\f\f#-\ufffd\ufffdCr\ufffdTc\n^\u0000\ufffd\u0015U\ufffd\ufffdi\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8898 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdc`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u04d3W\ufffda\ufffdHwS\ufffd\ufffdf0\u0607\ufffd j\ufffd\ufffdn\u045369\ufffdA#-\ufffd\ufffdCr\ufffdTc\n^\ufffdU\ufffd\ufffdi&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 56.33,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.78016341654201,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8686,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c977ab65d9c5b00524823837e891e1c775ea02df",
    "event_fingerprint": "76618bc1c33b7f0ae9962b8aabe6a53e315f94f5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a91f5b0b671e79a11401e1962cd8b4ed",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8686,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\u0016\u06b6 5\ufffd\ufffd\ufffd\ufffd\u0016\ufffdy\ufffd\ufffd)\u001f1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\b\ufffdB\u0016yf\ufffd\ufffd\ufffdHn\u0013k3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\u0016\u06b6 5\ufffd\ufffd\ufffd\ufffd\u0016\ufffdy\ufffd\ufffd)\u001f1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\b\ufffdB\u0016yf\ufffd\ufffd\ufffdHn\u0013k3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdU,\ufffd\ufffd`=1\ufffd\ufffd\ufffd\u0010d!\ufffd\u0012\u0756\ufffd\f\ufffd\ufffd\u0010D\t\ufffd\ufffd~h \ufffdc",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\u0016\u06b6 5\ufffd\ufffd\ufffd\ufffd\u0016\ufffdy\ufffd\ufffd)\u001f1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\b\ufffdB\u0016yf\ufffd\ufffd\ufffdHn\u0013k3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5ea6604dbb1e5d902f0a7362ea4eb5f827900d9d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\u0016\u06b6 5\ufffd\ufffd\ufffd\ufffd\u0016\ufffdy\ufffd\ufffd)\u001f1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\b\ufffdB\u0016yf\ufffd\ufffd\ufffdHn\u0013k3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8686,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\u06b6 5\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd)1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\ufffdByf\ufffd\ufffd\ufffdHnk3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8686 \u00b7 (reconnaissance)",
    "target_port_label": "8686 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8686,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\u0016\u06b6 5\ufffd\ufffd\ufffd\ufffd\u0016\ufffdy\ufffd\ufffd)\u001f1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\b\ufffdB\u0016yf\ufffd\ufffd\ufffdHn\u0013k3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8686,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8686 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\u06b6 5\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd)1\ueeae'a\u06d6\ufffd\r-;\ufffdn \ufffd\ufffdByf\ufffd\ufffd\ufffdHnk3\ufffd&\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u592cJ\ufffd~\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8686 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8686"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 56.17,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.886263588104326,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8700,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d812c07bdbb2c3fd98f38446c503242d7b7d58d9",
    "event_fingerprint": "164d6c166a8388d7dc517c88f842ea4a5a5acd98",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "79e6fd7a8a03815c6b88b4440a0b827e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8700,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\u0003\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdl\u0003P\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\u0003\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdl\u0003P\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ~\ufffd\ufffdj\ufffd\ufffdl}\ufffd\ufffd?\ufffd\ufffdx\ufffd\ufffd!\ufffd0\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\u0003\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdl\u0003P\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "568a2f9aa1b6e9e43a2f3cae38a5d3b424bec7c4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\u0003\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdl\u0003P\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8700,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdlP\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8700 \u00b7 (reconnaissance)",
    "target_port_label": "8700 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8700,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\u0003\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdl\u0003P\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8700,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8700 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd}\t\ufffdlB_\ufffd\ufffd\ufffd\ufffd[b\ufffdl\ufffdN\ufffd#\ufffd&-m)]\\S\ufffdZ1 \ufffd \ufffd\ufffd\ufffd\r\ufffd=X\ufffdlP\ufffd\ufffd_\ufffd\ufffdi\ufffd\ufffd%U\ufffd\ufffd\n\ufffdJ\ufffds_&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8700 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8700"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 55.98,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.795792443711507,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 8585,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "dc2f07f217ee2131b669580f86509adbff4479c2",
    "event_fingerprint": "91ff822936b4ce55b8c0dc108d145743ea2de907",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3eb38ba4f89074949f6f7ce72de415b2",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8585,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\u0011\ufffd\ufffdSG\u0013H\ufffd\u0018 a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\u001f\ufffdz\ufffd3O\ufffdp\ufffd\ufffd\u0012uf7\ufffd\u0007T\bt$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\u0011\ufffd\ufffdSG\u0013H\ufffd\u0018 a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\u001f\ufffdz\ufffd3O\ufffdp\ufffd\ufffd\u0012uf7\ufffd\u0007T\bt$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0012\u0508\u0013\u001f\\~r\n\u001e\ufffd\ufffd$\ufffd\ufffdX\ufffd\u001f\u0578.\ri\u0011\ufffd#\ufffd\u0011>\ufffd;",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\u0011\ufffd\ufffdSG\u0013H\ufffd\u0018 a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\u001f\ufffdz\ufffd3O\ufffdp\ufffd\ufffd\u0012uf7\ufffd\u0007T\bt$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5c1b635f789a3e679769e31bb19ca5bf6ba20ee3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\u0011\ufffd\ufffdSG\u0013H\ufffd\u0018 a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\u001f\ufffdz\ufffd3O\ufffdp\ufffd\ufffd\u0012uf7\ufffd\u0007T\bt$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8585,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\ufffd\ufffdSGH\ufffd a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\ufffdz\ufffd3O\ufffdp\ufffd\ufffduf7\ufffdTt$&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via TLS:8585 \u00b7 (reconnaissance)",
    "target_port_label": "8585 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8585,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\u0011\ufffd\ufffdSG\u0013H\ufffd\u0018 a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\u001f\ufffdz\ufffd3O\ufffdp\ufffd\ufffd\u0012uf7\ufffd\u0007T\bt$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8585,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:8585 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\u0568n\ufffd\ufffdN8\ufffd\ufffd!\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\t\ufffd;%n!\ufffd\ufffdSGH\ufffd a\u1c76\ufffd\ufffd\ufffd\ufffdb'}\ufffd\ufffdz\ufffd3O\ufffdp\ufffd\ufffduf7\ufffdTt$&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8585 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8585"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 55.79,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 239,
    "payload_entropy": 5.911179083240329,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "rtsp-alt",
    "app_proto": "rtsp-alt",
    "asn": 396982,
    "country": "US",
    "dst_port": 8554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "08794ddf90853c118ca3939fe7e8441bf4dbf144",
    "event_fingerprint": "c7af2434b883805246cd6e3fe371f895d3cc5f1d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "rtsp-alt",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "93f8e7c7d2a555a7b8b5818bbfff781e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8554,
        "service": "rtsp-alt",
        "service_name": "rtsp-alt",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\u0000\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\u0016\ufffd\ufffd`t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\u0000\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\u0016\ufffd\ufffd`t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd:?\u0014\ufffd\u01ce\ufffd\u001bX\ufffdnA]\ufffd\ufffdI\u001aqQ\ufffd\n(`B\ufffd,:t\ufffdn",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\u0000\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\u0016\ufffd\ufffd`t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a965d453e0b2a60186e9cac94f86777303ed6e4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\u0000\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\u0016\ufffd\ufffd`t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8554,
        "service": "rtsp-alt",
        "service_label_fr": "RTSP ALT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd`t\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
    "target_port_label": "8554 \u00b7 RTSP ALT",
    "emulator_service": "rtsp-alt",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP ALT \u2014 multi-protocole (78 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rtsp-alt",
        "service_label_fr": "RTSP ALT",
        "dst_port": 8554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp-alt",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\u0000\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\u0016\ufffd\ufffd`t\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8554,
            "service": "rtsp-alt",
            "service_label_fr": "RTSP ALT"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\u044e\u054f\ufffd\"\ufffd\ufffdab\u0366\ufffd\ufffd\ufffd\ufffdiI[$\ufffd\ufffd\u0689m6\ufffd\ufffd \ufffd \ufffdz\ufffds\ufffdz\ufffdx<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd6\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd`t\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8554 \u00b7 RTSP ALT",
        "emulator_service": "rtsp-alt",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp_alt",
        "service_banner": "honeypot-rtsp-alt",
        "service_os": "linux",
        "dst_port": "8554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 161,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        85,
        88,
        554,
        591,
        1080,
        1443,
        2000,
        2001,
        2082,
        2083,
        2086,
        2087
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 161,
    "scan_velocity_ports_per_s": 55.65,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "game",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 78,
    "multi_protocol_sample": [
        "activemq-console",
        "admin-alt",
        "aws-ecs-agent",
        "cassandra",
        "cassandra-jmx",
        "clickhouse-native",
        "consul-server",
        "consul-wan"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}