{"ip":"139.144.207.206","exported_at":"2026-10-23T13:16:04+00:00","period_days":30,"metrics":{"events7d":29,"distinct_ports":7,"distinct_classifications":6,"max_severity":8,"last_sensor_id":"paris-1","max_waf_score":16,"max_risk_score":53,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["unknown","IP signal\u00e9e (IPsum, 3 listes ou plus)","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0,"risk_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":23,"executive_one_liner_fr":"Activit\u00e9 suspecte","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":24},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":0,"confidence_hint_fr":"Confiance non \u00e9tablie","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"accessbuilder \u00b7 via ACCESSBUILDER:888 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\u0014\ufffdk\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u00004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000","tls_ja3":"cba7f34191ef2379c1325641f6c6c4f4","tls_ja4":"a3a5f53d3656a0df675e8aa020d5979e","port":888,"service":"accessbuilder","service_label_fr":"ACCESSBUILDER"},"protocol_summary_fr":"JA3 cba7f34191ef2379 \u00b7 Payload \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\u0014\ufffdk\ufffd\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u2026 \u00b7 ACCESSBUILDER:888","evidence_snippet":"{wd\ufffd;\ufffd\ufffdU\ufffd9xc8C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\ufffdk\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd","target_port_label":"888 \u00b7 ACCESSBUILDER","emulator_service":"accessbuilder","confidence_reason":"Confiance 0 % \u2014 1 signal(aux) capteur","classification_reason":"Type \u00ab accessbuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%","classification_reason_label_fr":"Type \u00ab Sonde AccessBuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence_factors_fr":null,"payload_preview":"{wd\ufffd;\ufffd\ufffdU\ufffd9xc8C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\ufffdk\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n4\n\r\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"206.207.144.139.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":6988241,"ip":"139.144.207.206","ts":"2026-10-23 06:13:13.000000","proto":"tcp","src_port":58132,"dst_port":888,"service":"accessbuilder","classification":"accessbuilder","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206163636573736275696c64657220726561647920706f72743d3838380d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 4.8364192807946536, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022app_proto\u0022: \u0022accessbuilder\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228a6333597f4952d1e5ef27052026a6c588b2a929\u0022, \u0022event_fingerprint\u0022: \u0022b56863f7f50b0166998f71f7d1d3fee6f8d34cf7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab accessbuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f058d692d472ab26f6bf89b223990a2a\u0022, \u0022path_pattern_hash\u0022: \u0022cd2fe1e1f588b76d342f6ca9e1858d9e\u0022, \u0022ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja3\u0022: \u0022771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0\u0022, \u0022tls_ja4_hash\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_ja4\u0022: \u0022t13d0113_ad3470b4f447_40d2e578a3e2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\\u0014\ufffdk\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\\u0014\ufffdk\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\\u0014\ufffdk\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab accessbuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002290c9d4445ec61c3d54ca687b3ef5f771072a935b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\\u0014\ufffdk\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022}, \u0022evidence_snippet\u0022: \u0022{wd\ufffd;\ufffd\ufffdU\ufffd9xc8C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\ufffdk\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022attack_vector\u0022: \u0022accessbuilder \u00b7 via ACCESSBUILDER:888 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022888 \u00b7 ACCESSBUILDER\u0022, \u0022emulator_service\u0022: \u0022accessbuilder\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab accessbuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab accessbuilder \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022, \u0022dst_port\u0022: 888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-accessbuilder\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003d\ufffd;\ufffd\ufffdU\ufffd9xc\\u00048C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\\u0014\ufffdk\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022}, \u0022attack_vector\u0022: \u0022accessbuilder \u00b7 via ACCESSBUILDER:888 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022{wd\ufffd;\ufffd\ufffdU\ufffd9xc8C\ufffdh\ufffdbJJ]\ufffde)\ufffdC~\ufffdk\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022target_port_label\u0022: \u0022888 \u00b7 ACCESSBUILDER\u0022, \u0022emulator_service\u0022: \u0022accessbuilder\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022accessbuilder\u0022, \u0022service_banner\u0022: \u0022honeypot-accessbuilder\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":128},{"id":6988239,"ip":"139.144.207.206","ts":"2026-10-23 06:13:12.000000","proto":"tcp","src_port":58128,"dst_port":888,"service":"accessbuilder","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206163636573736275696c64657220726561647920706f72743d3838380d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.404289612049766, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022app_proto\u0022: \u0022accessbuilder\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229bdfbbeb1b8b6b3a78f92e2766f1bb869a07cb8a\u0022, \u0022event_fingerprint\u0022: \u00220b6e30bfddc6387c11df7cce23d55e1f4de2ee58\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022063ba56dde083eaa9c078dd409b486e8\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002269cf843af10aac014ecf6eea33d55c306cb6f399\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via ACCESSBUILDER:888 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u0022888 \u00b7 ACCESSBUILDER\u0022, \u0022emulator_service\u0022: \u0022accessbuilder\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via ACCESSBUILDER\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022, \u0022dst_port\u0022: 888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-accessbuilder\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022port\u0022: 888, \u0022service\u0022: \u0022accessbuilder\u0022, \u0022service_label_fr\u0022: \u0022ACCESSBUILDER\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via ACCESSBUILDER:888 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:888\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022target_port_label\u0022: \u0022888 \u00b7 ACCESSBUILDER\u0022, \u0022emulator_service\u0022: \u0022accessbuilder\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022accessbuilder\u0022, \u0022service_banner\u0022: \u0022honeypot-accessbuilder\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_mozi_pattern\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_mozi_pattern\u0022]","anomalies":"[]","severity":8,"bytes_in":201},{"id":6448943,"ip":"139.144.207.206","ts":"2026-10-22 08:10:47.000000","proto":"tcp","src_port":48166,"dst_port":1337,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002229eb7064ac60b6748d87727e5ef8f5ef636716fb\u0022, \u0022http_host_hash\u0022: \u0022e970e1123d345de9d5824e11de9cdb81bcedfb97\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 202, \u0022payload_entropy\u0022: 5.386718678592677, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b4762be713e06c45b84a3bea4ee0b11fbebc7108\u0022, \u0022event_fingerprint\u0022: \u0022237767dba29c60c52aa388921042b312827b2136\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.7, \u0022classification_confidence\u0022: 0.7, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00220bec5af24b825fe0d2d2fc2d22b46622\u0022, \u0022payload_hash\u0022: \u0022bac1126787fbaf4053f689d20d9a6a35\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d303dbc728703e7a4c2296513c974f47f6ff6205\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:1337 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 70, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:1337 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:1337\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 96}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:1337","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":202},{"id":6448939,"ip":"139.144.207.206","ts":"2026-10-22 08:10:47.000000","proto":"tcp","src_port":48150,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022bcaf16a3843945b730c186fa2feb5c1b\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022hq\u0022, \u0022h2c\u0022, \u0022h2\u0022, \u0022spdy\/3\u0022, \u0022spdy\/2\u0022, \u0022spdy\/1\u0022, \u0022http\/1.1\u0022, \u0022http\/1.0\u0022, \u0022http\/0.9\u0022], \u0022bytes_in\u0022: 439, \u0022payload_entropy\u0022: 6.083101619480942, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u00229d8cb3566e0902327139f69853f1102942410055\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022bcaf16a3843945b730c186fa2feb5c1b\u0022, \u0022payload_hash\u0022: \u00220334ebc9ff3c936b2c14de3658c9e706\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdC\\u001f\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\\u0019\ufffdw\ufffdzT\\u0000\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\\u0010\ufffdj\ufffd\u032a\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdC\\u001f\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\\u0019\ufffdw\ufffdzT\\u0000\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\\u0010\ufffdj\ufffd\u032a\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u001a\\u001a\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdC\\u001f\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\\u0019\ufffdw\ufffdzT\\u0000\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\\u0010\ufffdj\ufffd\u032a\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222835b3c6c129c28d7ca823a350d5e9c71af30621\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdC\\u001f\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\\u0019\ufffdw\ufffdzT\\u0000\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\\u0010\ufffdj\ufffd\u032a\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022tls_ja3\u0022: \u0022bcaf16a3843945b730c186fa2feb5c1b\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdC\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\ufffdw\ufffdzT\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\ufffdj\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdC\\u001f\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\\u0019\ufffdw\ufffdzT\\u0000\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\\u0010\ufffdj\ufffd\u032a\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022tls_ja3\u0022: \u0022bcaf16a3843945b730c186fa2feb5c1b\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdC\ufffdZ\ufffd^=\ufffd\ufffdMy\ufffd\ufffd_8V|)87\ufffdB8(\ufffd\ufffd\ufffd\ufffd \ufffdN\ufffdw\ufffdzT\ufffd\ufffd~\ufffd\ufffdi\ufffd\ufffd\ufffdJ\ufffd\/\ufffd\ufffde\ufffd\ufffdj\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"bcaf16a3843945b730c186fa2feb5c1b","tls_ja3":"771,56026-49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,6682-0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":439},{"id":6448938,"ip":"139.144.207.206","ts":"2026-10-22 08:10:46.000000","proto":"tcp","src_port":48148,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 416, \u0022payload_entropy\u0022: 5.9251807018413984, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u0022b1a372cb22de573a1950c425b3608db730fd8fc6\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022payload_hash\u0022: \u00227ae5914190d27032fb387b1f79a4deb6\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\\u0004\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\\u0002\ufffd\ufffd\ufffdzRj)\\u0011\\u001c0t\ufffdh@\u0026U\ufffd\ufffd`\\u000fq\ufffd\\u0017\\n\ufffd\ufffd\ufffd3p\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\\u0004\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\\u0002\ufffd\ufffd\ufffdzRj)\\u0011\\u001c0t\ufffdh@\u0026U\ufffd\ufffd`\\u000fq\ufffd\\u0017\\n\ufffd\ufffd\ufffd3p\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\\u0004\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\\u0002\ufffd\ufffd\ufffdzRj)\\u0011\\u001c0t\ufffdh@\u0026U\ufffd\ufffd`\\u000fq\ufffd\\u0017\\n\ufffd\ufffd\ufffd3p\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002209f786dd93059fe12a7dd132b1b4a1fa9a62fd56\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\\u0004\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\\u0002\ufffd\ufffd\ufffdzRj)\\u0011\\u001c0t\ufffdh@\u0026U\ufffd\ufffd`\\u000fq\ufffd\\u0017\\n\ufffd\ufffd\ufffd3p\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdW\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\ufffd\ufffd\ufffdzRj)0t\ufffdh@\u0026U\ufffd\ufffd`q\ufffd\\n\ufffd\ufffd\ufffd3p\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\\u0004\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\\u0002\ufffd\ufffd\ufffdzRj)\\u0011\\u001c0t\ufffdh@\u0026U\ufffd\ufffd`\\u000fq\ufffd\\u0017\\n\ufffd\ufffd\ufffd3p\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdW\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd79+dO\ufffd_\ufffd\ufffd\ufffdnw{g)e\ufffd\ufffdZ\ufffd0#\ufffd (\ufffd\ufffd\ufffd\ufffdzRj)0t\ufffdh@\u0026U\ufffd\ufffd`q\ufffd\\n\ufffd\ufffd\ufffd3p\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":"62.3.50.33","tls_ja3_hash":"917fde1bf3bcb67f961b77b18d9ee14a","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":416},{"id":6448937,"ip":"139.144.207.206","ts":"2026-10-22 08:10:46.000000","proto":"tcp","src_port":48138,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 5.951917518872975, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u00220e9481ea4666f03c8a7a37da70fa486e15570031\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022payload_hash\u0022: \u00229a984e47db7496eae7593e5acd604262\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003c\ufffd\ufffd\ufffdj\ufffdYT\\u0010\\u0010yD\\u000f`\\u0000\ufffd\ufffd\\t:\\f\ufffdYH\ufffdY\\r\ufffda\ufffd\\u0018\ufffd\\u0014 \\u0010P\ufffd\ufffd\\u0013\ufffdm\u0027\ufffds*)\\\u0022S\\u000ew\ufffd\\u001b\ufffd9\ufffd\ufffdZ\\u001f\ufffd\ufffd3#!\\u0004\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003c\ufffd\ufffd\ufffdj\ufffdYT\\u0010\\u0010yD\\u000f`\\u0000\ufffd\ufffd\\t:\\f\ufffdYH\ufffdY\\r\ufffda\ufffd\\u0018\ufffd\\u0014 \\u0010P\ufffd\ufffd\\u0013\ufffdm\u0027\ufffds*)\\\u0022S\\u000ew\ufffd\\u001b\ufffd9\ufffd\ufffdZ\\u001f\ufffd\ufffd3#!\\u0004\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003c\ufffd\ufffd\ufffdj\ufffdYT\\u0010\\u0010yD\\u000f`\\u0000\ufffd\ufffd\\t:\\f\ufffdYH\ufffdY\\r\ufffda\ufffd\\u0018\ufffd\\u0014 \\u0010P\ufffd\ufffd\\u0013\ufffdm\u0027\ufffds*)\\\u0022S\\u000ew\ufffd\\u001b\ufffd9\ufffd\ufffdZ\\u001f\ufffd\ufffd3#!\\u0004\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229196eece1538ef0e3ba64581975a7a2e083e852f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003c\ufffd\ufffd\ufffdj\ufffdYT\\u0010\\u0010yD\\u000f`\\u0000\ufffd\ufffd\\t:\\f\ufffdYH\ufffdY\\r\ufffda\ufffd\\u0018\ufffd\\u0014 \\u0010P\ufffd\ufffd\\u0013\ufffdm\u0027\ufffds*)\\\u0022S\\u000ew\ufffd\\u001b\ufffd9\ufffd\ufffdZ\\u001f\ufffd\ufffd3#!\\u0004\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdc\ufffd\ufffd\ufffdj\ufffdYTyD`\ufffd\ufffd\\t:\ufffdYH\ufffdY\\r\ufffda\ufffd\ufffd P\ufffd\ufffd\ufffdm\u0027\ufffds*)\\\u0022Sw\ufffd\ufffd9\ufffd\ufffdZ\ufffd\ufffd3#!\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003c\ufffd\ufffd\ufffdj\ufffdYT\\u0010\\u0010yD\\u000f`\\u0000\ufffd\ufffd\\t:\\f\ufffdYH\ufffdY\\r\ufffda\ufffd\\u0018\ufffd\\u0014 \\u0010P\ufffd\ufffd\\u0013\ufffdm\u0027\ufffds*)\\\u0022S\\u000ew\ufffd\\u001b\ufffd9\ufffd\ufffdZ\\u001f\ufffd\ufffd3#!\\u0004\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdc\ufffd\ufffd\ufffdj\ufffdYTyD`\ufffd\ufffd\\t:\ufffdYH\ufffdY\\r\ufffda\ufffd\ufffd P\ufffd\ufffd\ufffdm\u0027\ufffds*)\\\u0022Sw\ufffd\ufffd9\ufffd\ufffdZ\ufffd\ufffd3#!\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"013c30c8ce44c8b27e9ceb2a14db7283","tls_ja3":"771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":426},{"id":6448934,"ip":"139.144.207.206","ts":"2026-10-22 08:10:46.000000","proto":"tcp","src_port":48134,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022hq\u0022, \u0022h2c\u0022, \u0022h2\u0022, \u0022spdy\/3\u0022, \u0022spdy\/2\u0022, \u0022spdy\/1\u0022, \u0022http\/1.1\u0022, \u0022http\/1.0\u0022, \u0022http\/0.9\u0022], \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 5.975957481759045, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u0022d3bb8dce09b8e85562ed7ed3e7443f45b1824785\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022payload_hash\u0022: \u0022eadf23b80dd807c73bcd4491d275e025\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd\\u0011:\\u001a\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\\u000b\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\\\u00174\\u0019\ufffd\\u001e\ufffd\ufffd\\f~\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd\\u0011:\\u001a\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\\u000b\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\\\u00174\\u0019\ufffd\\u001e\ufffd\ufffd\\f~\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd\\u0011:\\u001a\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\\u000b\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\\\u00174\\u0019\ufffd\\u001e\ufffd\ufffd\\f~\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ae1d3ac75dd5ac87fc9aae3b4dc3179f8990650d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd\\u0011:\\u001a\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\\u000b\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\\\u00174\\u0019\ufffd\\u001e\ufffd\ufffd\\f~\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd:\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\4\ufffd\ufffd\ufffd~\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd\\u0011:\\u001a\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\\u000b\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\\\u00174\\u0019\ufffd\\u001e\ufffd\ufffd\\f~\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd5\ufffd2P+\ufffd\ufffd~#V\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdK\ufffdG\ufffd\ufffd\ufffd:\ufffd\ufffd59 \uc783R\ufffdc\ufffd\u003EP\ufffd\ufffd\ufffd\ufffd`\ufffd\u025a1\ufffd\ufffd\\\\4\ufffd\ufffd\ufffd~\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"db8d4ad49cb378fa370b43a61a9b06b6","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":426},{"id":6448933,"ip":"139.144.207.206","ts":"2026-10-22 08:10:46.000000","proto":"tcp","src_port":48126,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 413, \u0022payload_entropy\u0022: 6.0123567527459185, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u0022b8502963d665057ab378d1c1d37bcec31c2489fa\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022payload_hash\u0022: \u00228e64c2b340b8a4fcd26ae49ea3627b8e\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\\u0014\u0027\ufffdg_\ufffd\ufffd\ufffd\\u0012|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \\u0002\ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02dd\\u0012E\ufffd$-\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\\u0014\u0027\ufffdg_\ufffd\ufffd\ufffd\\u0012|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \\u0002\ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02dd\\u0012E\ufffd$-\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\\u0014\u0027\ufffdg_\ufffd\ufffd\ufffd\\u0012|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \\u0002\ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02dd\\u0012E\ufffd$-\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002298f5b8f9a0f65f1696139bb3bc6ae88522e78ce7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\\u0014\u0027\ufffdg_\ufffd\ufffd\ufffd\\u0012|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \\u0002\ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02dd\\u0012E\ufffd$-\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\u0027\ufffdg_\ufffd\ufffd\ufffd|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02ddE\ufffd$-\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\\u0014\u0027\ufffdg_\ufffd\ufffd\ufffd\\u0012|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \\u0002\ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02dd\\u0012E\ufffd$-\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdjf\ufffd\ufffdb\ufffdf\ufffd\ufffd_\u0027\ufffdg_\ufffd\ufffd\ufffd|\ufffd\u01d08(\ufffd\ufffd\ufffd\u0677 \ufffd\ufffd#\ufffd\\n\ufffd~Iy\ufffd!\ufffd6w0\\t\ufffd|\ufffd\ufffdc\ufffdN\u02ddE\ufffd$-\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"006315b3ad276906ff11527f9594e5ba","tls_ja3":"770,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":413},{"id":6448929,"ip":"139.144.207.206","ts":"2026-10-22 08:10:45.000000","proto":"tcp","src_port":48124,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002209c1d53bf76696f4bf6bdacfcc266af3\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022hq\u0022, \u0022h2c\u0022, \u0022spdy\/3\u0022, \u0022spdy\/2\u0022, \u0022spdy\/1\u0022, \u0022http\/1.0\u0022, \u0022http\/0.9\u0022], \u0022bytes_in\u0022: 412, \u0022payload_entropy\u0022: 6.028695053795659, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u002239e6bd38e46695ca29eced87775e404fa3ab9486\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002209c1d53bf76696f4bf6bdacfcc266af3\u0022, \u0022payload_hash\u0022: \u002270e9331c66b304baa66b3aa346ac2c13\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0016O\ufffd\ufffd\ufffd\ufffd\\\u0022|\\b\ufffd\ufffd\u0252-\ufffd\u010c\\u001f\ufffd%#\ufffd\ufffdZ\ufffd\ufffd\\u0016{\ufffd \ufffdjW\\u0013\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF\\u000240]Z\ufffd\ufffd-\ufffd\ufffd\ufffd\\foC\ufffdwo.\\u000ei\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0016O\ufffd\ufffd\ufffd\ufffd\\\u0022|\\b\ufffd\ufffd\u0252-\ufffd\u010c\\u001f\ufffd%#\ufffd\ufffdZ\ufffd\ufffd\\u0016{\ufffd \ufffdjW\\u0013\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF\\u000240]Z\ufffd\ufffd-\ufffd\ufffd\ufffd\\foC\ufffdwo.\\u000ei\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0016O\ufffd\ufffd\ufffd\ufffd\\\u0022|\\b\ufffd\ufffd\u0252-\ufffd\u010c\\u001f\ufffd%#\ufffd\ufffdZ\ufffd\ufffd\\u0016{\ufffd \ufffdjW\\u0013\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF\\u000240]Z\ufffd\ufffd-\ufffd\ufffd\ufffd\\foC\ufffdwo.\\u000ei\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a5f619e070180b1e9564b733237ef00ebd00839f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0016O\ufffd\ufffd\ufffd\ufffd\\\u0022|\\b\ufffd\ufffd\u0252-\ufffd\u010c\\u001f\ufffd%#\ufffd\ufffdZ\ufffd\ufffd\\u0016{\ufffd \ufffdjW\\u0013\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF\\u000240]Z\ufffd\ufffd-\ufffd\ufffd\ufffd\\foC\ufffdwo.\\u000ei\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022tls_ja3\u0022: \u002209c1d53bf76696f4bf6bdacfcc266af3\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\\\u0022|\ufffd\ufffd\u0252-\ufffd\u010c\ufffd%#\ufffd\ufffdZ\ufffd\ufffd{\ufffd \ufffdjW\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF40]Z\ufffd\ufffd-\ufffd\ufffd\ufffdoC\ufffdwo.i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0016O\ufffd\ufffd\ufffd\ufffd\\\u0022|\\b\ufffd\ufffd\u0252-\ufffd\u010c\\u001f\ufffd%#\ufffd\ufffdZ\ufffd\ufffd\\u0016{\ufffd \ufffdjW\\u0013\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF\\u000240]Z\ufffd\ufffd-\ufffd\ufffd\ufffd\\foC\ufffdwo.\\u000ei\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022tls_ja3\u0022: \u002209c1d53bf76696f4bf6bdacfcc266af3\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\\\u0022|\ufffd\ufffd\u0252-\ufffd\u010c\ufffd%#\ufffd\ufffdZ\ufffd\ufffd{\ufffd \ufffdjW\ufffd\ufffd\u0027\ufffd\ufffd\ufffdxF40]Z\ufffd\ufffd-\ufffd\ufffd\ufffdoC\ufffdwo.i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"09c1d53bf76696f4bf6bdacfcc266af3","tls_ja3":"771,43690-49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,60138-0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":412},{"id":6448927,"ip":"139.144.207.206","ts":"2026-10-22 08:10:45.000000","proto":"tcp","src_port":48108,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 11, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 331, \u0022payload_entropy\u0022: 6.0158320822672415, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u00225b6637bb9ed3240565880a4d619320d0745fb0ad\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022payload_hash\u0022: \u00227f3a6c570b49f36618d74bc834c1bafb\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffd\\u0016jy\u003EsIC\\u0003\\u0001\ufffd\\u0007\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\\u000f\\u000e\ufffd\ufffdp\ufffd\ufffd\ufffd\\u001cb\\u0006;\u0731\ufffd)\ufffd\ufffd\\u0011\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffd\\u0016jy\u003EsIC\\u0003\\u0001\ufffd\\u0007\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\\u000f\\u000e\ufffd\ufffdp\ufffd\ufffd\ufffd\\u001cb\\u0006;\u0731\ufffd)\ufffd\ufffd\\u0011\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u00000\\u0000.\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\u0003h2c\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffd\\u0016jy\u003EsIC\\u0003\\u0001\ufffd\\u0007\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\\u000f\\u000e\ufffd\ufffdp\ufffd\ufffd\ufffd\\u001cb\\u0006;\u0731\ufffd)\ufffd\ufffd\\u0011\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e42e2d4628a53b6e9b219e82f895a299e1ad2439\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffd\\u0016jy\u003EsIC\\u0003\\u0001\ufffd\\u0007\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\\u000f\\u000e\ufffd\ufffdp\ufffd\ufffd\ufffd\\u001cb\\u0006;\u0731\ufffd)\ufffd\ufffd\\u0011\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022FB\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffdjy\u003EsIC\ufffd\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffdb;\u0731\ufffd)\ufffd\ufffd\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffd\\u0016jy\u003EsIC\\u0003\\u0001\ufffd\\u0007\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\\u000f\\u000e\ufffd\ufffdp\ufffd\ufffd\ufffd\\u001cb\\u0006;\u0731\ufffd)\ufffd\ufffd\\u0011\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022FB\\t\ufffd\ufffd\ufffdBOsI\ufffdz\ufffd\ufffdMG\ufffd\ufffdjy\u003EsIC\ufffd\ufffdP\ufffd\ufffda \ufffd\ufffd\\\u0022|I|\\t\u02ba7\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffdb;\u0731\ufffd)\ufffd\ufffd\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"a96dc3876784813c57d302241e620acd","tls_ja3":"771,49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":331},{"id":6448926,"ip":"139.144.207.206","ts":"2026-10-22 08:10:45.000000","proto":"tcp","src_port":48104,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 9, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 345, \u0022payload_entropy\u0022: 6.062970408846251, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u00220d3027851e5f69a2f90b4da33a80dd379df4fcf4\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022payload_hash\u0022: \u0022ae0ffa34b85f8f277e4dd767982ca03f\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\u003C\\u0000:\\bhttp\/0.9\\bhttp\/1.0\\bhttp\/1.1\\u0006spdy\/1\\u0006spdy\/2\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\u003C\\u0000:\\bhttp\/0.9\\bhttp\/1.0\\bhttp\/1.1\\u0006spdy\/1\\u0006spdy\/2\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224c157aefe833b13c6d1c8a8260642623a022cd0a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022TP\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffdu3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\ufffd\ufffd\/w\ufffda\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffd\\u0016u3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\\u0017\ufffd\ufffd\/w\\f\ufffda\ufffd\ufffd\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022TP\u0291\ufffd\ufffdhJ\u00f4\ufffd\u06ed.O\ufffd\ufffd3 \ufffdV\ufffd:I\ufffdu3\ufffd\u003CE\ufffdu \\t\ufffd\ufffd.\u0364\ufffdX \ufffd\u026a\ufffdv+\ufffd5\ufffd\ufffd\\rVc\ufffd\ufffd\/w\ufffda\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"03a3ad27040f733ee5c9915e0903d028","tls_ja3":"771,49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":345},{"id":6448925,"ip":"139.144.207.206","ts":"2026-10-22 08:10:45.000000","proto":"tcp","src_port":48102,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 6.015550048583001, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u00220e9481ea4666f03c8a7a37da70fa486e15570031\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022payload_hash\u0022: \u00228cdd154593b4206a3eef8a9e17e3f588\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\u04d9\ufffd\ufffd\\u000bQ\\u0013\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\\f\\u0016\\f\u0082\ufffdq\\u0018\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\u04d9\ufffd\ufffd\\u000bQ\\u0013\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\\f\\u0016\\f\u0082\ufffdq\\u0018\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\u04d9\ufffd\ufffd\\u000bQ\\u0013\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\\f\\u0016\\f\u0082\ufffdq\\u0018\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228f277eef40cfcde05dec3c21ff9f3fce2eb79fad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\u04d9\ufffd\ufffd\\u000bQ\\u0013\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\\f\\u0016\\f\u0082\ufffdq\\u0018\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd+\ufffd\u04d9\ufffd\ufffdQ\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\u0082\ufffdq\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\u04d9\ufffd\ufffd\\u000bQ\\u0013\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\\f\\u0016\\f\u0082\ufffdq\\u0018\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd+\ufffd\u04d9\ufffd\ufffdQ\ufffde\ufffd\ufffdH\ua20a\ufffd\ufffd\\r:\ufffdX\ufffdLq\u0410k\u00261 \ufffd\ufffd\u0082\ufffdq\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\\u00225.a,*\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"013c30c8ce44c8b27e9ceb2a14db7283","tls_ja3":"771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":424},{"id":6448922,"ip":"139.144.207.206","ts":"2026-10-22 08:10:45.000000","proto":"tcp","src_port":48086,"dst_port":1337,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022hq\u0022, \u0022h2c\u0022, \u0022h2\u0022, \u0022spdy\/3\u0022, \u0022spdy\/2\u0022, \u0022spdy\/1\u0022, \u0022http\/1.1\u0022, \u0022http\/1.0\u0022, \u0022http\/0.9\u0022], \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 5.939601204659168, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022155cdbbbb2d7f278ee02aa31b3522bf2a0785ec7\u0022, \u0022event_fingerprint\u0022: \u0022d3bb8dce09b8e85562ed7ed3e7443f45b1824785\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022payload_hash\u0022: \u0022dd61067991f6cfd05fe77e181a229fa8\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Z\\u000b\ufffd\u003Eq\ufffd~\\u0014\ufffd\\u000e\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6\\f 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\\u0005\ufffdV\ufffdhf\\u0000\ufffd\ufffd6]\\u0019\\u0007\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Z\\u000b\ufffd\u003Eq\ufffd~\\u0014\ufffd\\u000e\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6\\f 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\\u0005\ufffdV\ufffdhf\\u0000\ufffd\ufffd6]\\u0019\\u0007\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Z\\u000b\ufffd\u003Eq\ufffd~\\u0014\ufffd\\u000e\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6\\f 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\\u0005\ufffdV\ufffdhf\\u0000\ufffd\ufffd6]\\u0019\\u0007\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022686a9a96de1f1947273b3f58d61b98e1e9a5db93\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Z\\u000b\ufffd\u003Eq\ufffd~\\u0014\ufffd\\u000e\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6\\f 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\\u0005\ufffdV\ufffdhf\\u0000\ufffd\ufffd6]\\u0019\\u0007\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdZ\ufffd\u003Eq\ufffd~\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\ufffdV\ufffdhf\ufffd\ufffd6]\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Z\\u000b\ufffd\u003Eq\ufffd~\\u0014\ufffd\\u000e\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6\\f 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\\u0005\ufffdV\ufffdhf\\u0000\ufffd\ufffd6]\\u0019\\u0007\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdZ\ufffd\u003Eq\ufffd~\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdM{\ufffd6@b#Vp\ufffdxt\\na\\n \ufffd\ufffd6 7\ufffd\ufffd\ufffd\ufffdaP\\\\b\u0027f\ufffdu\ufffd\ufffdV\ufffdhf\ufffd\ufffd6]\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"db8d4ad49cb378fa370b43a61a9b06b6","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":424},{"id":6448920,"ip":"139.144.207.206","ts":"2026-10-22 08:10:44.000000","proto":"tcp","src_port":48074,"dst_port":1337,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 6, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 4.873059561543816, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c432e4df5b120f4201c0ee899ebb11e5a8dacff8\u0022, \u0022event_fingerprint\u0022: \u0022ea76a1f72c102616c0262e9722139243ea089ced\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022payload_hash\u0022: \u00224a2f728e2966dd0b14aca04ad31a8b4a\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0\u0022, \u0022tls_ja4_hash\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_ja4\u0022: \u0022t13d0113_ad3470b4f447_40d2e578a3e2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0002t\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\\f\ufffd\u0499p2V$J?\ufffd\\u0017\ufffd\ufffd\ufffd\ufffdc\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0002t\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\\f\ufffd\u0499p2V$J?\ufffd\\u0017\ufffd\ufffd\ufffd\ufffdc\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0002t\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\\f\ufffd\u0499p2V$J?\ufffd\\u0017\ufffd\ufffd\ufffd\ufffdc\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223330add9426c114ad70cd91597a2daa64999ad6e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0002t\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\\f\ufffd\u0499p2V$J?\ufffd\\u0017\ufffd\ufffd\ufffd\ufffdc\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022{wt\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\ufffd\u0499p2V$J?\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0002t\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\\f\ufffd\u0499p2V$J?\ufffd\\u0017\ufffd\ufffd\ufffd\ufffdc\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022{wt\ufffd\ufffd\ufffd\ufffd\u0026f\u003C\ufffd\u00d2\ufffd\ufffd\u0499p2V$J?\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_ja3":"771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":128},{"id":6448915,"ip":"139.144.207.206","ts":"2026-10-22 08:10:44.000000","proto":"tcp","src_port":48072,"dst_port":1337,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 6, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 4.882787002933164, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 1337, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c432e4df5b120f4201c0ee899ebb11e5a8dacff8\u0022, \u0022event_fingerprint\u0022: \u0022ea76a1f72c102616c0262e9722139243ea089ced\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022payload_hash\u0022: \u0022bedb1d876ab7cf8d1363f2c227e72ed4\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0\u0022, \u0022tls_ja4_hash\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022tls_ja4\u0022: \u0022t13d0113_ad3470b4f447_40d2e578a3e2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 13, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0018Y\ufffdX\ufffd!\\u001c1\ufffd\ufffd\\\u0022\ufffd\\u000e\ufffd\\u001d\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\\f\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0018Y\ufffdX\ufffd!\\u001c1\ufffd\ufffd\\\u0022\ufffd\\u000e\ufffd\\u001d\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\\f\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0018Y\ufffdX\ufffd!\\u001c1\ufffd\ufffd\\\u0022\ufffd\\u000e\ufffd\\u001d\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\\f\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227c68ef12b3043de91d1f6ac32642509a46231f22\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0018Y\ufffdX\ufffd!\\u001c1\ufffd\ufffd\\\u0022\ufffd\\u000e\ufffd\\u001d\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\\f\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022{wY\ufffdX\ufffd!1\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1337, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000{\\u0001\\u0000\\u0000w\\u0003\\u0003\\u0018Y\ufffdX\ufffd!\\u001c1\ufffd\ufffd\\\u0022\ufffd\\u000e\ufffd\\u001d\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\\f\ufffd\ufffd\\u0000\\u0000\\u001a\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0001\\u0000\\u00004\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022cba7f34191ef2379c1325641f6c6c4f4\u0022, \u0022tls_ja4\u0022: \u0022a3a5f53d3656a0df675e8aa020d5979e\u0022, \u0022port\u0022: 1337, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:1337 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022{wY\ufffdX\ufffd!1\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\u4e33\ufffdN3\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n4\\n\\r\ufffd\u0022, \u0022target_port_label\u0022: \u00221337 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221337\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_ja3":"771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":128},{"id":5682799,"ip":"139.144.207.206","ts":"2026-10-21 02:48:18.000000","proto":"tcp","src_port":33080,"dst_port":8899,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002229eb7064ac60b6748d87727e5ef8f5ef636716fb\u0022, \u0022http_host_hash\u0022: \u00222fb63756fe5a0e4d86498992fb1b091f8f61fad8\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 202, \u0022payload_entropy\u0022: 5.428735911429382, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8899, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228ec8c9c54bc1e068ff6f8b5f4174578af15eff4f\u0022, \u0022event_fingerprint\u0022: \u00227ff128363fbe74328e7551abeb09946be29f2bab\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00220bec5af24b825fe0d2d2fc2d22b46622\u0022, \u0022payload_hash\u0022: \u0022aacdfe572d2e680ab21b12fdaea84f12\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8899, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002231074badc31a5d622a221bac8b5c2244348766db\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8899, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8899 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228899 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8899, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8899, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8899 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8899\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022target_port_label\u0022: \u00228899 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228899\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8899","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":202},{"id":4990825,"ip":"139.144.207.206","ts":"2026-10-19 23:21:39.000000","proto":"tcp","src_port":52484,"dst_port":8084,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002229eb7064ac60b6748d87727e5ef8f5ef636716fb\u0022, \u0022http_host_hash\u0022: \u002252139ff216422f6e734a2f69155b92f0ec67e9f8\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 202, \u0022payload_entropy\u0022: 5.402576443532629, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8084, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224dcbeae7e50d8a691f6670393a93509e80d866a5\u0022, \u0022event_fingerprint\u0022: \u0022ebc906b0f0074f27e2e4f93dcdc76e075f5acfe4\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00220bec5af24b825fe0d2d2fc2d22b46622\u0022, \u0022payload_hash\u0022: \u00226fbf60fb79d3cd3f5885e6e862bafe4a\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8084, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a0e0ebd2cba411f57097a96d9a5962c2f08807a7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8084, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8084 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228084 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8084, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8084, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8084 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8084\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022target_port_label\u0022: \u00228084 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228084\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8084","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":202},{"id":4523124,"ip":"139.144.207.206","ts":"2026-10-19 05:27:27.000000","proto":"tcp","src_port":50510,"dst_port":8085,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002229eb7064ac60b6748d87727e5ef8f5ef636716fb\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 202, \u0022payload_entropy\u0022: 5.398344993174839, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229269fbc73faf84ae739a4cd696c041e500aa4102\u0022, \u0022event_fingerprint\u0022: \u00220fcaa6a995d1cdf34f87aa636ef596625b2ef958\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00220bec5af24b825fe0d2d2fc2d22b46622\u0022, \u0022payload_hash\u0022: \u00224bfc031264f360f10c9434df47211761\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022beed5e8f5c27ac1728aed44b94ae51278b849584\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8085 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:8085 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":202},{"id":3941875,"ip":"139.144.207.206","ts":"2026-10-18 11:39:19.000000","proto":"tcp","src_port":48986,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 439, \u0022payload_entropy\u0022: 5.97758483755514, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ddd7346bb62b6c2091e8d2d425caa569\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003h\\u0011\u0777\ufffd\u054c\ufffd\ufffd\\u000e\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd\\u0014$\ufffd\\n\ufffd\ufffdqX \\u0001\ufffdPC\ufffd\ufffd9\\u0003\ufffdU\ufffd\ufffd-\ufffd\ufffd\\u0001ta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003h\\u0011\u0777\ufffd\u054c\ufffd\ufffd\\u000e\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd\\u0014$\ufffd\\n\ufffd\ufffdqX \\u0001\ufffdPC\ufffd\ufffd9\\u0003\ufffdU\ufffd\ufffd-\ufffd\ufffd\\u0001ta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\u067a\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003h\\u0011\u0777\ufffd\u054c\ufffd\ufffd\\u000e\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd\\u0014$\ufffd\\n\ufffd\ufffdqX \\u0001\ufffdPC\ufffd\ufffd9\\u0003\ufffdU\ufffd\ufffd-\ufffd\ufffd\\u0001ta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dcee1cf59bd99cba1a8caa8431e43ff0baf76366\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003h\\u0011\u0777\ufffd\u054c\ufffd\ufffd\\u000e\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd\\u0014$\ufffd\\n\ufffd\ufffdqX \\u0001\ufffdPC\ufffd\ufffd9\\u0003\ufffdU\ufffd\ufffd-\ufffd\ufffd\\u0001ta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdh\u0777\ufffd\u054c\ufffd\ufffd\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd$\ufffd\\n\ufffd\ufffdqX \ufffdPC\ufffd\ufffd9\ufffdU\ufffd\ufffd-\ufffd\ufffdta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003h\\u0011\u0777\ufffd\u054c\ufffd\ufffd\\u000e\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd\\u0014$\ufffd\\n\ufffd\ufffdqX \\u0001\ufffdPC\ufffd\ufffd9\\u0003\ufffdU\ufffd\ufffd-\ufffd\ufffd\\u0001ta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdh\u0777\ufffd\u054c\ufffd\ufffd\u03bb\ufffd\/\ufffd\ufffd%\ufffdLx\ufffdDj\ufffd$\ufffd\\n\ufffd\ufffdqX \ufffdPC\ufffd\ufffd9\ufffdU\ufffd\ufffd-\ufffd\ufffdta\ufffd\\t\ufffdW\ufffd\ufffd\ufffdY\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":439},{"id":3941871,"ip":"139.144.207.206","ts":"2026-10-18 11:39:19.000000","proto":"tcp","src_port":48974,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 416, \u0022payload_entropy\u0022: 5.973755528267663, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d88a39bfd16164bb3d83d94d9fee5caf\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003xG\\u0019\ufffd\\u0003ym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0004\\u0010H=\ufffdZ\ufffd8\\u0014\\u0004G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\\u000e\ufffd\\r7\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003xG\\u0019\ufffd\\u0003ym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0004\\u0010H=\ufffdZ\ufffd8\\u0014\\u0004G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\\u000e\ufffd\\r7\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003xG\\u0019\ufffd\\u0003ym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0004\\u0010H=\ufffdZ\ufffd8\\u0014\\u0004G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\\u000e\ufffd\\r7\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002209471422a11a56693f8869c0c4d96158555ee3e4\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003xG\\u0019\ufffd\\u0003ym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0004\\u0010H=\ufffdZ\ufffd8\\u0014\\u0004G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\\u000e\ufffd\\r7\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdxG\ufffdym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffdH=\ufffdZ\ufffd8G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\\r7\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003xG\\u0019\ufffd\\u0003ym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0004\\u0010H=\ufffdZ\ufffd8\\u0014\\u0004G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\\u000e\ufffd\\r7\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdxG\ufffdym5`\ufffd1Hxm\u0026\ufffd\ufffd\ufffd\ufffd\ufffdH=\ufffdZ\ufffd8G\ufffd \ufffd[\ufffdL,\ufffd\ufffd\ufffdo\ufffdG \ufffd\ufffd\ufffdS\ufffd8k9\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\\r7\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":416},{"id":3941867,"ip":"139.144.207.206","ts":"2026-10-18 11:39:19.000000","proto":"tcp","src_port":48962,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 6.005290401200638, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002260d6a17705a279d92f4d724ecbc32899\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\\u001d\ufffdj\u04e6\ufffd\ufffd\\u0000\\u0016kNM\\u001f\\u0019\ufffd1\ufffd\ufffdXP\\u0005\\u0013\ufffdG\ufffd\ufffd\\b\\u0006\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\\u001d\ufffdj\u04e6\ufffd\ufffd\\u0000\\u0016kNM\\u001f\\u0019\ufffd1\ufffd\ufffdXP\\u0005\\u0013\ufffdG\ufffd\ufffd\\b\\u0006\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\\u001d\ufffdj\u04e6\ufffd\ufffd\\u0000\\u0016kNM\\u001f\\u0019\ufffd1\ufffd\ufffdXP\\u0005\\u0013\ufffdG\ufffd\ufffd\\b\\u0006\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f3c8d944edc611075aa5648e05d521b3d6fa636f\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\\u001d\ufffdj\u04e6\ufffd\ufffd\\u0000\\u0016kNM\\u001f\\u0019\ufffd1\ufffd\ufffdXP\\u0005\\u0013\ufffdG\ufffd\ufffd\\b\\u0006\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\ufffdj\u04e6\ufffd\ufffdkNM\ufffd1\ufffd\ufffdXP\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\\u001d\ufffdj\u04e6\ufffd\ufffd\\u0000\\u0016kNM\\u001f\\u0019\ufffd1\ufffd\ufffdXP\\u0005\\u0013\ufffdG\ufffd\ufffd\\b\\u0006\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd!\ufffdh\ufffdq\ufffdYz\ufffd\ufffd\ufffdF\ufffd\u07db\ufffd\ufffdc52\ufffd%\u064c g\ufffd\ufffd\ufffd\ufffdj\u04e6\ufffd\ufffdkNM\ufffd1\ufffd\ufffdXP\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":426},{"id":3941862,"ip":"139.144.207.206","ts":"2026-10-18 11:39:19.000000","proto":"tcp","src_port":48954,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 6.012884961481751, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229041d98be3c8ec7f1cc423e3fffe757b\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003}\ufffd\\u0007,\ufffd\ufffd\\u0007Z\ufffdsl\ufffdqV\ufffd#\\u001300\u003C$\u07dax\\r\u003El(\\u0006\ufffd\ufffd\\u0019 Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\\u0016\ufffd\\\\\ufffd\\u001bB*a\ufffd\\b%%v\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003}\ufffd\\u0007,\ufffd\ufffd\\u0007Z\ufffdsl\ufffdqV\ufffd#\\u001300\u003C$\u07dax\\r\u003El(\\u0006\ufffd\ufffd\\u0019 Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\\u0016\ufffd\\\\\ufffd\\u001bB*a\ufffd\\b%%v\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003}\ufffd\\u0007,\ufffd\ufffd\\u0007Z\ufffdsl\ufffdqV\ufffd#\\u001300\u003C$\u07dax\\r\u003El(\\u0006\ufffd\ufffd\\u0019 Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\\u0016\ufffd\\\\\ufffd\\u001bB*a\ufffd\\b%%v\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229812b235f2edf6198eed96dd6f80acb7df0e1f67\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003}\ufffd\\u0007,\ufffd\ufffd\\u0007Z\ufffdsl\ufffdqV\ufffd#\\u001300\u003C$\u07dax\\r\u003El(\\u0006\ufffd\ufffd\\u0019 Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\\u0016\ufffd\\\\\ufffd\\u001bB*a\ufffd\\b%%v\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd}\ufffd,\ufffd\ufffdZ\ufffdsl\ufffdqV\ufffd#00\u003C$\u07dax\\r\u003El(\ufffd\ufffd Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffdB*a\ufffd%%v\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003}\ufffd\\u0007,\ufffd\ufffd\\u0007Z\ufffdsl\ufffdqV\ufffd#\\u001300\u003C$\u07dax\\r\u003El(\\u0006\ufffd\ufffd\\u0019 Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\\u0016\ufffd\\\\\ufffd\\u001bB*a\ufffd\\b%%v\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd}\ufffd,\ufffd\ufffdZ\ufffdsl\ufffdqV\ufffd#00\u003C$\u07dax\\r\u003El(\ufffd\ufffd Yo\ufffdL\ufffd\ufffdpXoB9\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffdB*a\ufffd%%v\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":426},{"id":3941861,"ip":"139.144.207.206","ts":"2026-10-18 11:39:18.000000","proto":"tcp","src_port":48940,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 413, \u0022payload_entropy\u0022: 5.964267438654946, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ba1ea68e2da0e044fd8e26d85beee23e\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002gc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\\u0018\ufffd!\\u0015\ufffd\ufffdL\ufffd\ufffd1\\u0000\ufffd[p\ufffdR\\u0000\ufffd\ufffd\\u001d\ufffd `\ufffdX\\t#\\u0017B\ufffdx\ufffd\ufffd\ufffd\\u0012\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002gc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\\u0018\ufffd!\\u0015\ufffd\ufffdL\ufffd\ufffd1\\u0000\ufffd[p\ufffdR\\u0000\ufffd\ufffd\\u001d\ufffd `\ufffdX\\t#\\u0017B\ufffdx\ufffd\ufffd\ufffd\\u0012\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002gc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\\u0018\ufffd!\\u0015\ufffd\ufffdL\ufffd\ufffd1\\u0000\ufffd[p\ufffdR\\u0000\ufffd\ufffd\\u001d\ufffd `\ufffdX\\t#\\u0017B\ufffdx\ufffd\ufffd\ufffd\\u0012\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228fe4a98ea53306bc2cbc380fd29b371d154a9c86\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002gc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\\u0018\ufffd!\\u0015\ufffd\ufffdL\ufffd\ufffd1\\u0000\ufffd[p\ufffdR\\u0000\ufffd\ufffd\\u001d\ufffd `\ufffdX\\t#\\u0017B\ufffdx\ufffd\ufffd\ufffd\\u0012\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdgc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\ufffd!\ufffd\ufffdL\ufffd\ufffd1\ufffd[p\ufffdR\ufffd\ufffd\ufffd `\ufffdX\\t#B\ufffdx\ufffd\ufffd\ufffd\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002gc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\\u0018\ufffd!\\u0015\ufffd\ufffdL\ufffd\ufffd1\\u0000\ufffd[p\ufffdR\\u0000\ufffd\ufffd\\u001d\ufffd `\ufffdX\\t#\\u0017B\ufffdx\ufffd\ufffd\ufffd\\u0012\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdgc\ufffd\ufffd\u0027v\\t\ufffd\ufffdR\ufffd!\ufffd\ufffdL\ufffd\ufffd1\ufffd[p\ufffdR\ufffd\ufffd\ufffd `\ufffdX\\t#B\ufffdx\ufffd\ufffd\ufffd\ufffdf\\\u0022\ufffdI\ufffd,\u037a\ufffdC\ufffd\ufffdg\ufffd\ufffd$\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":413},{"id":3941860,"ip":"139.144.207.206","ts":"2026-10-18 11:39:18.000000","proto":"tcp","src_port":48936,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 412, \u0022payload_entropy\u0022: 5.984183654699452, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d1bbaee15e6427af98c869eac93b82e\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0013\ufffdX(k\\u001e i\ufffd\u06e2\ufffdbCH\\bTFJ\ufffd(\ufffd\\u0004\\u0012s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\\f\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\\u0001\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\\u0000\ufffd**\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0013\ufffdX(k\\u001e i\ufffd\u06e2\ufffdbCH\\bTFJ\ufffd(\ufffd\\u0004\\u0012s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\\f\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\\u0001\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\\u0000\ufffd**\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0013\ufffdX(k\\u001e i\ufffd\u06e2\ufffdbCH\\bTFJ\ufffd(\ufffd\\u0004\\u0012s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\\f\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\\u0001\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\\u0000\ufffd**\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b77ef9c3bf6ab6e36834ab57dd1f0cd67d3595d2\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0013\ufffdX(k\\u001e i\ufffd\u06e2\ufffdbCH\\bTFJ\ufffd(\ufffd\\u0004\\u0012s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\\f\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\\u0001\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\\u0000\ufffd**\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdX(k i\ufffd\u06e2\ufffdbCHTFJ\ufffd(\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\ufffd**\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0013\ufffdX(k\\u001e i\ufffd\u06e2\ufffdbCH\\bTFJ\ufffd(\ufffd\\u0004\\u0012s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\\f\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\\u0001\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\\u0000\ufffd**\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdX(k i\ufffd\u06e2\ufffdbCHTFJ\ufffd(\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd K\ufffdH\ufffd\ufffdub7\ufffdcE\ufffd\ufffdAV(\uca33\ufffd^2\ufffdrG\ufffd\\\u0022\ufffd\ufffd**\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":412},{"id":3941857,"ip":"139.144.207.206","ts":"2026-10-18 11:39:18.000000","proto":"tcp","src_port":48928,"dst_port":2404,"service":"iec104","classification":"iec104_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 331, \u0022payload_entropy\u0022: 5.9661724101659095, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022iec104\u0022, \u0022app_proto\u0022: \u0022iec104\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2404, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e169d60097e1e9b97bd241ca925ecff0beec25c\u0022, \u0022event_fingerprint\u0022: \u002299a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022confidence\u0022: 0.81, \u0022classification_confidence\u0022: 0.81, \u0022precision_score\u0022: 91, \u0022precision_signals\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_confidence_factor\u0022: 81.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c0b8ded24e446ffa15e8c739b0c57048\u0022, \u0022path_pattern_hash\u0022: \u002209bd81a4aaa94733fb840e5e256406fa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003J,\ufffda\ufffd5Y\\u0001\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\\u0002\\u001c\ufffd\u003C\ufffd\ufffd\ufffdv5?\\f \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffd\\u0018D$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9\\u001b%\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003J,\ufffda\ufffd5Y\\u0001\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\\u0002\\u001c\ufffd\u003C\ufffd\ufffd\ufffdv5?\\f \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffd\\u0018D$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9\\u001b%\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u00000\\u0000.\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\u0003h2c\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003J,\ufffda\ufffd5Y\\u0001\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\\u0002\\u001c\ufffd\u003C\ufffd\ufffd\ufffdv5?\\f \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffd\\u0018D$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9\\u001b%\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022, \u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ef6bc05b5cbc70010634ae57acbcf5e40349ed0e\u0022, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003J,\ufffda\ufffd5Y\\u0001\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\\u0002\\u001c\ufffd\u003C\ufffd\ufffd\ufffdv5?\\f \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffd\\u0018D$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9\\u001b%\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022evidence_snippet\u0022: \u0022FBJ,\ufffda\ufffd5Y\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\ufffd\u003C\ufffd\ufffd\ufffdv5? \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffdD$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9%D\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 81, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022, \u0022dst_port\u0022: 2404, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-OT-iec104-startdt\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Ot Iec104 Startdt\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022iec104_probe_fr\u0022: \u0022Protocole IEC 60870-5-104 (STARTDT)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003J,\ufffda\ufffd5Y\\u0001\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\\u0002\\u001c\ufffd\u003C\ufffd\ufffd\ufffdv5?\\f \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffd\\u0018D$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9\\u001b%\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022port\u0022: 2404, \u0022service\u0022: \u0022iec104\u0022, \u0022service_label_fr\u0022: \u0022IEC104\u0022}, \u0022attack_vector\u0022: \u0022iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022FBJ,\ufffda\ufffd5Y\ufffd\ufffd\\n\ufffd)\ufffd\u018fk q\\t\ufffd\ufffd\u003C\ufffd\ufffd\ufffdv5? \ufffd\ufffdc\ufffd]hz\ufffd\ufffd\ufffdh\ufffd$@\ufffdD$\ufffd\ufffde{\ufffd\ufffd\ufffd\ufffd\ufffdK9%D\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00222404 \u00b7 IEC104\u0022, \u0022emulator_service\u0022: \u0022iec104\u0022, \u0022confidence_reason\u0022: \u0022Confiance 81 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 81 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022iec104\u0022, \u0022service_banner\u0022: \u0022honeypot-iec104\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222404\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022iec104_emulated\u0022, \u0022net_iec104_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":331}],"total_events":29}