{"ip":"139.59.210.62","exported_at":"2026-10-19T00:48:31+00:00","period_days":30,"metrics":{"events7d":10,"distinct_ports":8,"distinct_classifications":8,"max_severity":7,"last_sensor_id":"paris-1","max_waf_score":0,"max_risk_score":42,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner","IP signal\u00e9e (IPsum, 3 listes ou plus)"],"recommended_action":"monitor","confidence":0.49,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":9,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":49,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0369"],"tags_summary":["pat-0369"],"attack_vector":"postgres probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\u0022\ufffd+\ufffd\ufffd\u001d\u0010 \u0554\b\u0004\ufffd\t\ufffd\u000b\ufffdtM\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001","tls_ja3":"96458b3de39df5d47bc5c4a9f10f8f26","port":6000,"service":"tls","service_label_fr":"TLS"},"protocol_summary_fr":"JA3 96458b3de39df5d4 \u00b7 Payload \u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\u0022\ufffd+\ufffd\ufffd\u001d\u0010 \u0554\b\u0004\ufffd\t\ufffd\u000b\ufffdtM\u0000\ufffd\ufffd+\ufffd57N\ufffd^\u2026 \u00b7 TLS:6000","evidence_snippet":"\ufffde\ufffdp\ufffd.\ufffd\ufffdT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\u0022\ufffd+\ufffd\ufffd \u0554\ufffd\t\ufffd\ufffdtM\ufffd\ufffd+\ufffd57N\ufffd^\ufffdN\u0026\ufffd\ufffdD\u05d9\ufffdu\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd","target_port_label":"6000 \u00b7 TLS","emulator_service":"tls","confidence_reason":"Confiance 49 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","classification_reason_label_fr":"Type \u00ab Sonde PostgreSQL \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence_factors_fr":"Confiance 49 % \u2014 Score WAF 8","payload_preview":"\ufffde\ufffdp\ufffd.\ufffd\ufffdT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\u0022\ufffd+\ufffd\ufffd \u0554\ufffd\t\ufffd\ufffdtM\ufffd\ufffd+\ufffd57N\ufffd^\ufffdN\u0026\ufffd\ufffdD\u05d9\ufffdu\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"62.210.59.139.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.3","meaning":"Sonde ou scan","label":"Sonde PostgreSQL"},"events":[{"id":3768128,"ip":"139.59.210.62","ts":"2026-10-18 06:16:41.000000","proto":"tcp","src_port":37236,"dst_port":6000,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 4, \u0022bytes_in\u0022: 273, \u0022payload_entropy\u0022: 5.653828921826322, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002202e811be5bb54dede32290f05478455a42ee8958\u0022, \u0022event_fingerprint\u0022: \u0022957ef16d076aa94f5d07c7b97d5b7adced09a456\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022payload_hash\u0022: \u002221c0d943fdf67c3ac7e916356cc04278\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd\\u001d\\u0010 \u0554\\b\\u0004\ufffd\\t\ufffd\\u000b\ufffdtM\\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd\\u001d\\u0010 \u0554\\b\\u0004\ufffd\\t\ufffd\\u000b\ufffdtM\\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd5K\ufffd\ufffdw8\ufffd\\u0002\\u0010%w`J\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd\\u001d\\u0010 \u0554\\b\\u0004\ufffd\\t\ufffd\\u000b\ufffdtM\\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bdcd4b8e6bd264105f0439de9b110450d33fd586\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd\\u001d\\u0010 \u0554\\b\\u0004\ufffd\\t\ufffd\\u000b\ufffdtM\\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022tls_ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffde\ufffdp\ufffd.\ufffd\ufffdT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd \u0554\ufffd\\t\ufffd\ufffdtM\ufffd\ufffd+\ufffd57N\ufffd^\ufffdN\u0026\ufffd\ufffdD\u05d9\ufffdu\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\\u0017\ufffde\ufffdp\ufffd.\ufffd\ufffd\\u001eT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd\\u001d\\u0010 \u0554\\b\\u0004\ufffd\\t\ufffd\\u000b\ufffdtM\\u0000\ufffd\ufffd+\ufffd57N\ufffd^\ufffd\\u0016N\u0026\ufffd\ufffdD\u05d9\ufffdu\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022tls_ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffde\ufffdp\ufffd.\ufffd\ufffdT`:j\u02d1\ufffd\ufffd\ufffd\ufffd\ufffdJUe\ufffd\\\u0022\ufffd+\ufffd\ufffd \u0554\ufffd\\t\ufffd\ufffdtM\ufffd\ufffd+\ufffd57N\ufffd^\ufffdN\u0026\ufffd\ufffdD\u05d9\ufffdu\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00226000 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"96458b3de39df5d47bc5c4a9f10f8f26","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":273},{"id":3768125,"ip":"139.59.210.62","ts":"2026-10-18 06:16:41.000000","proto":"tcp","src_port":37228,"dst_port":6000,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 4, \u0022bytes_in\u0022: 273, \u0022payload_entropy\u0022: 5.688325361601248, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002202e811be5bb54dede32290f05478455a42ee8958\u0022, \u0022event_fingerprint\u0022: \u0022957ef16d076aa94f5d07c7b97d5b7adced09a456\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022payload_hash\u0022: \u0022d3b4bda5c11bcebfa45f28d882d41685\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\ufffd\ufffdZ|\ufffdp\u0644!yb%\\u0015\\u0013\\u001d\ufffdd\ufffdg\u003CG\ufffd\\u0002\ufffdZ\ufffd\ufffd\\u0014\\u0003^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC\\u001a_\\u000f\ufffd\ufffd\ufffd\ufffdb\ufffd9A\\u0007\\u001aJ\u062b;\\u001a\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\ufffd\ufffdZ|\ufffdp\u0644!yb%\\u0015\\u0013\\u001d\ufffdd\ufffdg\u003CG\ufffd\\u0002\ufffdZ\ufffd\ufffd\\u0014\\u0003^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC\\u001a_\\u000f\ufffd\ufffd\ufffd\ufffdb\ufffd9A\\u0007\\u001aJ\u062b;\\u001a\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 ~\ufffd\ufffd\\f:\ufffd\u0309+AUi\ufffd8\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\ufffd\ufffdZ|\ufffdp\u0644!yb%\\u0015\\u0013\\u001d\ufffdd\ufffdg\u003CG\ufffd\\u0002\ufffdZ\ufffd\ufffd\\u0014\\u0003^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC\\u001a_\\u000f\ufffd\ufffd\ufffd\ufffdb\ufffd9A\\u0007\\u001aJ\u062b;\\u001a\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022922881ef01d91f3a1c392b29349986fc3f93454e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\ufffd\ufffdZ|\ufffdp\u0644!yb%\\u0015\\u0013\\u001d\ufffdd\ufffdg\u003CG\ufffd\\u0002\ufffdZ\ufffd\ufffd\\u0014\\u0003^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC\\u001a_\\u000f\ufffd\ufffd\ufffd\ufffdb\ufffd9A\\u0007\\u001aJ\u062b;\\u001a\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022tls_ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdZ|\ufffdp\u0644!yb%\ufffdd\ufffdg\u003CG\ufffd\ufffdZ\ufffd\ufffd^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC_\ufffd\ufffd\ufffd\ufffdb\ufffd9AJ\u062b;\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\f\\u0001\\u0000\\u0001\\b\\u0003\\u0003\ufffd\ufffdZ|\ufffdp\u0644!yb%\\u0015\\u0013\\u001d\ufffdd\ufffdg\u003CG\ufffd\\u0002\ufffdZ\ufffd\ufffd\\u0014\\u0003^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC\\u001a_\\u000f\ufffd\ufffd\ufffd\ufffdb\ufffd9A\\u0007\\u001aJ\u062b;\\u001a\\u0000\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\u0022, \u0022tls_ja3\u0022: \u002296458b3de39df5d47bc5c4a9f10f8f26\u0022, \u0022port\u0022: 6000, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdZ|\ufffdp\u0644!yb%\ufffdd\ufffdg\u003CG\ufffd\ufffdZ\ufffd\ufffd^\ufffd \ufffd\ufffdY\ufffdD5`\ufffd\ufffd\ufffd\u02cf\ufffdC_\ufffd\ufffd\ufffd\ufffdb\ufffd9AJ\u062b;\u0026\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00226000 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"96458b3de39df5d47bc5c4a9f10f8f26","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":273},{"id":3684707,"ip":"139.59.210.62","ts":"2026-10-18 04:05:39.000000","proto":"tcp","src_port":54474,"dst_port":995,"service":"pop3s","classification":"port_995_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00222b4f4b20504f503320686f6e6579706f742072656164790d0a\u0022, \u0022emulator_response_len\u0022: 25, \u0022bytes_in\u0022: 6, \u0022payload_entropy\u0022: 2.2516291673878226, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pop3s\u0022, \u0022app_proto\u0022: \u0022pop3s\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 995, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b049da4cb1600894cb1c9237a4611c1485f24e92\u0022, \u0022event_fingerprint\u0022: \u00220353453bbb76e4d6b1b3ea18095b3c0820f92351\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 69, \u0022precision_signals\u0022: [\u0022pat-0631\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0631\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0631\u0022], \u0022matched_pattern_names\u0022: [\u0022POP3S STLS\u0022], \u0022pattern_ids\u0022: [\u0022pat-0631\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022pop3_probe\u0022, \u0022service_name\u0022: \u0022pop3s\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022813470f1db1ec2e7586921e1e8c83ef5\u0022, \u0022path_pattern_hash\u0022: \u00222d7323af9a60223f53b8a7244c835e47\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 995, \u0022service\u0022: \u0022pop3s\u0022, \u0022service_name\u0022: \u0022pop3s\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022STLS\\r\\n\u0022, \u0022request_sample\u0022: \u0022STLS\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022STLS\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022STLS\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022STLS\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227f6fadcfb93192808ba4aa0046f49ff6f2c9149c\u0022, \u0022protocol_details\u0022: {\u0022pop3_auth_fr\u0022: \u0022Sonde protocole POP3 (USER\/PASS)\u0022, \u0022payload_preview\u0022: \u0022STLS\u0022, \u0022port\u0022: 995, \u0022service\u0022: \u0022pop3s\u0022, \u0022service_label_fr\u0022: \u0022POP3S\u0022}, \u0022evidence_snippet\u0022: \u0022STLS\u0022, \u0022attack_vector\u0022: \u0022port 995 tcp \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022995 \u00b7 POP3S\u0022, \u0022emulator_service\u0022: \u0022pop3s\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022pop3s\u0022, \u0022service_label_fr\u0022: \u0022POP3S\u0022, \u0022dst_port\u0022: 995, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0631\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0631\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pop3s\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022pop3_auth_fr\u0022: \u0022Sonde protocole POP3 (USER\/PASS)\u0022, \u0022payload_preview\u0022: \u0022STLS\u0022, \u0022port\u0022: 995, \u0022service\u0022: \u0022pop3s\u0022, \u0022service_label_fr\u0022: \u0022POP3S\u0022}, \u0022attack_vector\u0022: \u0022port 995 tcp \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022STLS\u0022, \u0022target_port_label\u0022: \u0022995 \u00b7 POP3S\u0022, \u0022emulator_service\u0022: \u0022pop3s\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pop3s\u0022, \u0022service_banner\u0022: \u0022honeypot-pop3s\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022995\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_pop3_probe\u0022, \u0022pop3_starttls\u0022, \u0022pop3s_emulated\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_pop3_probe\u0022, \u0022pop3_starttls\u0022, \u0022pop3s_emulated\u0022]","anomalies":"[]","severity":4,"bytes_in":6},{"id":2770242,"ip":"139.59.210.62","ts":"2026-10-16 14:44:40.000000","proto":"tcp","src_port":45726,"dst_port":9042,"service":"cassandra","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022840000000200000002\u0022, \u0022emulator_response_len\u0022: 9, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.007224283645818, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022cassandra\u0022, \u0022app_proto\u0022: \u0022cassandra\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 9042, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002240a95b0e32b0df6949d23e1558297d2ebdc45aed\u0022, \u0022event_fingerprint\u0022: \u0022a0aaefdb49226dd6e2577aeda4227e02b3ddd691\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228f1b8db19a5d046f2f55b92d2eb4014d\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja3\u0022: \u00221b9bb541fa237aff65acf838b154df7f\u0022, \u0022ja4\u0022: \u00227d55a26b02c27f625ff34bc84f8ab649\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 40, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00221b9bb541fa237aff65acf838b154df7f\u0022, \u0022tls_ja3\u0022: \u0022771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0\u0022, \u0022tls_ja4_hash\u0022: \u00227d55a26b02c27f625ff34bc84f8ab649\u0022, \u0022tls_ja4\u0022: \u0022t13d0140_c79c1c2c7c3c_40d2e578a3e2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 40, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003)\ufffd\ufffd\\u0002\ufffdH]\\nV\\u0016\\u0006P?\\\u0022\ufffd\ufffdT\ufffd\\u0010 C\ufffd\\u001e\ufffd|4a\ufffdOF\ufffd\\u0000\\u0000P\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd$\ufffd#\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032a\\u0000k\\u0000g\\u00009\\u00003\\u0000\\u0016\\u0000=\\u0000\u003C\\u0000\\u0004\\u0000\\u0014\\u0000\ufffd\\u0000\\u0015\ufffd,\ufffd0\\u0000\\b\\u0000\\u0006\\u0000\\u0003\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003)\ufffd\ufffd\\u0002\ufffdH]\\nV\\u0016\\u0006P?\\\u0022\ufffd\ufffdT\ufffd\\u0010 C\ufffd\\u001e\ufffd|4a\ufffdOF\ufffd\\u0000\\u0000P\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd$\ufffd#\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032a\\u0000k\\u0000g\\u00009\\u00003\\u0000\\u0016\\u0000=\\u0000\u003C\\u0000\\u0004\\u0000\\u0014\\u0000\ufffd\\u0000\\u0015\ufffd,\ufffd0\\u0000\\b\\u0000\\u0006\\u0000\\u0003\\u0001\\u0000\\u0000G\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0010\\u0000\\u000e\\u0004\\u0001\\u0004\\u0003\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003)\ufffd\ufffd\\u0002\ufffdH]\\nV\\u0016\\u0006P?\\\u0022\ufffd\ufffdT\ufffd\\u0010 C\ufffd\\u001e\ufffd|4a\ufffdOF\ufffd\\u0000\\u0000P\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd$\ufffd#\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032a\\u0000k\\u0000g\\u00009\\u00003\\u0000\\u0016\\u0000=\\u0000\u003C\\u0000\\u0004\\u0000\\u0014\\u0000\ufffd\\u0000\\u0015\ufffd,\ufffd0\\u0000\\b\\u0000\\u0006\\u0000\\u0003\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b157a32f6629b0723dfad81ac38936d274565099\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003)\ufffd\ufffd\\u0002\ufffdH]\\nV\\u0016\\u0006P?\\\u0022\ufffd\ufffdT\ufffd\\u0010 C\ufffd\\u001e\ufffd|4a\ufffdOF\ufffd\\u0000\\u0000P\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd$\ufffd#\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032a\\u0000k\\u0000g\\u00009\\u00003\\u0000\\u0016\\u0000=\\u0000\u003C\\u0000\\u0004\\u0000\\u0014\\u0000\ufffd\\u0000\\u0015\ufffd,\ufffd0\\u0000\\b\\u0000\\u0006\\u0000\\u0003\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00221b9bb541fa237aff65acf838b154df7f\u0022, \u0022tls_ja4\u0022: \u00227d55a26b02c27f625ff34bc84f8ab649\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd)\ufffd\ufffd\ufffdH]\\nVP?\\\u0022\ufffd\ufffdT\ufffd C\ufffd\ufffd|4a\ufffdOF\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032akg93=\u003C\ufffd\ufffd,\ufffd0\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022, \u0022dst_port\u0022: 9042, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003)\ufffd\ufffd\\u0002\ufffdH]\\nV\\u0016\\u0006P?\\\u0022\ufffd\ufffdT\ufffd\\u0010 C\ufffd\\u001e\ufffd|4a\ufffdOF\ufffd\\u0000\\u0000P\ufffd\/\ufffd+\ufffd\\u0011\ufffd\\u0007\ufffd\\u0013\ufffd\\t\ufffd\\u0014\ufffd\\n\\u0000\\u0005\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd$\ufffd#\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032a\\u0000k\\u0000g\\u00009\\u00003\\u0000\\u0016\\u0000=\\u0000\u003C\\u0000\\u0004\\u0000\\u0014\\u0000\ufffd\\u0000\\u0015\ufffd,\ufffd0\\u0000\\b\\u0000\\u0006\\u0000\\u0003\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00221b9bb541fa237aff65acf838b154df7f\u0022, \u0022tls_ja4\u0022: \u00227d55a26b02c27f625ff34bc84f8ab649\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd)\ufffd\ufffd\ufffdH]\\nVP?\\\u0022\ufffd\ufffdT\ufffd C\ufffd\ufffd|4a\ufffdOF\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\\t\ufffd\ufffd\\n\/5\ufffd\\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\u0027\u0329\u0328\u032akg93=\u003C\ufffd\ufffd,\ufffd0\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229042\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_native\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_native\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":201},{"id":2770236,"ip":"139.59.210.62","ts":"2026-10-16 14:44:39.000000","proto":"tcp","src_port":45716,"dst_port":9042,"service":"cassandra","classification":"cassandra_native","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022840000000200000002\u0022, \u0022emulator_response_len\u0022: 9, \u0022bytes_in\u0022: 148, \u0022payload_entropy\u0022: 5.1417076098349215, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022cassandra\u0022, \u0022app_proto\u0022: \u0022cassandra\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 9042, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b8cc2731612d020ecdcab58b5df800413f79ea60\u0022, \u0022event_fingerprint\u0022: \u0022a0aaefdb49226dd6e2577aeda4227e02b3ddd691\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022matched_patterns\u0022: [\u0022pat-0103\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI Double-dot bypass\u0022], \u0022pattern_ids\u0022: [\u0022pat-0103\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223d7db0c7621e936e9d1257ed1b89b879\u0022, \u0022path_pattern_hash\u0022: \u00228cb32c8386aedd3a6f34609a4f02f539\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227e4df39a000b137cbec5cf739f02cccbbc99fd44\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 37\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022, \u0022dst_port\u0022: 9042, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022attack_vector\u0022: \u0022cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9042\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229042\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_cassandra_native\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_cassandra_native\u0022]","anomalies":"[]","severity":7,"bytes_in":148},{"id":2693634,"ip":"139.59.210.62","ts":"2026-10-16 11:25:18.000000","proto":"tcp","src_port":17786,"dst_port":10250,"service":"http","classification":"sap_diag_probe","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/query?q=SHOW+DIAGNOSTICS","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 1, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022c3e68bb8f388240c7ecaebb8bcb80a85536526f2\u0022, \u0022http_host_hash\u0022: \u0022c6230b8ffdbe5af406d274ad0814962285e74f83\u0022, \u0022http_target_hash\u0022: \u0022148d0a7b9fa867b9eb3d978e0caa495e68940f78\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 117, \u0022payload_entropy\u0022: 5.237193601214321, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 10250, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c00a5ff52f7477222e04cb3185aff9cbf9c0eb7b\u0022, \u0022event_fingerprint\u0022: \u00226a6cb72310597af9a5e44c6c7c2dc0bf9bc5d556\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002212bd583dd25b868e6423d8f04cc19fd1\u0022, \u0022payload_hash\u0022: \u00221549fef36e210b9ac875f0f9cd380cff\u0022, \u0022path_pattern_hash\u0022: \u0022645c82d3be5cca3e8520101eb38681a7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10250, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 24}, \u0022payload_preview\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/query\u0022, \u0022query_string\u0022: \u0022q=SHOW+DIAGNOSTICS\u0022, \u0022user_agent\u0022: \u0022Go-http-client\/1.1\u0022, \u0022request_line\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/query\u0022, \u0022query_string\u0022: \u0022q=SHOW+DIAGNOSTICS\u0022, \u0022user_agent\u0022: \u0022Go-http-client\/1.1\u0022, \u0022request_line\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022sap_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e39a6fefb874b42983605491b8ce4ccc12585493\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/query\u0022, \u0022request_line\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Go-http-client\/1.1\u0022, \u0022port\u0022: 10250, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022attack_vector\u0022: \u0022Sonde SAP Diag\/GUI \u00b7 via HTTP:10250 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query\u0022, \u0022target_port_label\u0022: \u002210250 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 10250, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Kubernetes kubelet\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/query\u0022, \u0022request_line\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Go-http-client\/1.1\u0022, \u0022port\u0022: 10250, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde SAP Diag\/GUI \u00b7 via HTTP:10250 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query\u0022, \u0022evidence_snippet\u0022: \u0022GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\\r\\nHost: 62.3.50.33:10250\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022target_port_label\u0022: \u002210250 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022kubelet\u0022, \u0022service_banner\u0022: \u0022Kubernetes kubelet\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210250\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_ua_suspicious\u0022, \u0022net_sap_diag_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:10250","http_user_agent":"Go-http-client\/1.1","http_referer":null,"tags":"[\u0022http_ua_suspicious\u0022, \u0022net_sap_diag_probe\u0022]","anomalies":"[]","severity":6,"bytes_in":117},{"id":2673880,"ip":"139.59.210.62","ts":"2026-10-16 10:36:52.000000","proto":"tcp","src_port":4176,"dst_port":8500,"service":"consul","classification":"consul_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74\u0022, \u0022emulator_response_len\u0022: 138, \u0022bytes_in\u0022: 148, \u0022payload_entropy\u0022: 5.114680582807895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022consul\u0022, \u0022app_proto\u0022: \u0022consul\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 8500, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022af9594ea6f43e1773816eda1794f59876845647a\u0022, \u0022event_fingerprint\u0022: \u0022da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022matched_patterns\u0022: [\u0022pat-0103\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI Double-dot bypass\u0022], \u0022pattern_ids\u0022: [\u0022pat-0103\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022consul\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220f92a7230ff4c061051dd447140c7e88\u0022, \u0022path_pattern_hash\u0022: \u0022903d4a7efff645522f88fc15d7a1b2c2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8500, \u0022service\u0022: \u0022consul\u0022, \u0022service_name\u0022: \u0022consul\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002283544a22e6daa8f8ce774a7c62a56b7c28b76980\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022port\u0022: 8500, \u0022service\u0022: \u0022consul\u0022, \u0022service_label_fr\u0022: \u0022CONSUL\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228500 \u00b7 CONSUL\u0022, \u0022emulator_service\u0022: \u0022consul\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022consul\u0022, \u0022service_label_fr\u0022: \u0022CONSUL\u0022, \u0022dst_port\u0022: 8500, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-consul\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022port\u0022: 8500, \u0022service\u0022: \u0022consul\u0022, \u0022service_label_fr\u0022: \u0022CONSUL\u0022}, \u0022attack_vector\u0022: \u0022consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8500\\r\\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\\r\\nAccept: *\/*\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228500 \u00b7 CONSUL\u0022, \u0022emulator_service\u0022: \u0022consul\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022consul\u0022, \u0022service_banner\u0022: \u0022honeypot-consul\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228500\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022consul_emulated\u0022, \u0022consul_payload\u0022, \u0022consul_probe\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_consul_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022consul_emulated\u0022, \u0022consul_payload\u0022, \u0022consul_probe\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_consul_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":148},{"id":2357162,"ip":"139.59.210.62","ts":"2026-10-15 21:14:53.000000","proto":"tcp","src_port":64262,"dst_port":11434,"service":"ollama","classification":"ollama","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 297, \u0022payload_entropy\u0022: 5.795778215700043, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022ollama\u0022, \u0022app_proto\u0022: \u0022ollama\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 11434, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f2a17d825ce172bcf72ac0b1659a0f22375133c0\u0022, \u0022event_fingerprint\u0022: \u0022e5de7378bdf0b23e311530c009ea1c8bba9f0677\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab ollama \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022ollama\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229ce990b366cec13950eedd9ec3accb68\u0022, \u0022path_pattern_hash\u0022: \u002276e3c7bfe641ea125c0c2e1c5f89349e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 11434, \u0022service\u0022: \u0022ollama\u0022, \u0022service_name\u0022: \u0022ollama\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001$\\u0001\\u0000\\u0001 \\u0003\\u0003\\u000f\u05e3\ufffd6\u00bfT\\u001d\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\\u0016\ufffd\\u0018]\\u0013 d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa\\u0004~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdn\\u0010Q\ufffd\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001$\\u0001\\u0000\\u0001 \\u0003\\u0003\\u000f\u05e3\ufffd6\u00bfT\\u001d\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\\u0016\ufffd\\u0018]\\u0013 d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa\\u0004~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdn\\u0010Q\ufffd\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0003\\u0001\\u0003\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001$\\u0001\\u0000\\u0001 \\u0003\\u0003\\u000f\u05e3\ufffd6\u00bfT\\u001d\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\\u0016\ufffd\\u0018]\\u0013 d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa\\u0004~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdn\\u0010Q\ufffd\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ollama \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cab96af1c70355bba9ffe4c5bed5f41409de880c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001$\\u0001\\u0000\\u0001 \\u0003\\u0003\\u000f\u05e3\ufffd6\u00bfT\\u001d\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\\u0016\ufffd\\u0018]\\u0013 d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa\\u0004~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdn\\u0010Q\ufffd\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022port\u0022: 11434, \u0022service\u0022: \u0022ollama\u0022, \u0022service_label_fr\u0022: \u0022OLLAMA\u0022}, \u0022evidence_snippet\u0022: \u0022$ \u05e3\ufffd6\u00bfT\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd] d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdnQ\ufffd\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\\n\ufffd9\ufffd\\t\ufffd3\ufffd\u0022, \u0022attack_vector\u0022: \u0022ollama \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002211434 \u00b7 OLLAMA\u0022, \u0022emulator_service\u0022: \u0022ollama\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ollama \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ollama \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022ollama\u0022, \u0022service_label_fr\u0022: \u0022OLLAMA\u0022, \u0022dst_port\u0022: 11434, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-ollama\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001$\\u0001\\u0000\\u0001 \\u0003\\u0003\\u000f\u05e3\ufffd6\u00bfT\\u001d\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\\u0016\ufffd\\u0018]\\u0013 d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa\\u0004~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdn\\u0010Q\ufffd\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022port\u0022: 11434, \u0022service\u0022: \u0022ollama\u0022, \u0022service_label_fr\u0022: \u0022OLLAMA\u0022}, \u0022attack_vector\u0022: \u0022ollama \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022$ \u05e3\ufffd6\u00bfT\ufffdk\ufffd\ufffd\uab95\ufffd\u084c\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd] d4\ufffdy]\ufffd\ufffd{,\ufffd\ufffdNZa~n\ufffd\ufffdQ\ufffd+\ufffd\ufffd\ufffd~\ufffdnQ\ufffd\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\\n\ufffd9\ufffd\\t\ufffd3\ufffd\u0022, \u0022target_port_label\u0022: \u002211434 \u00b7 OLLAMA\u0022, \u0022emulator_service\u0022: \u0022ollama\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022ollama\u0022, \u0022service_banner\u0022: \u0022honeypot-ollama\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002211434\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":297},{"id":2314181,"ip":"139.59.210.62","ts":"2026-10-15 19:49:01.000000","proto":"tcp","src_port":21358,"dst_port":9092,"service":"kafka","classification":"imap_bruteforce","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00220000000c2f63676900000001000b0000\u0022, \u0022emulator_response_len\u0022: 16, \u0022bytes_in\u0022: 113, \u0022payload_entropy\u0022: 4.942788176570397, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022kafka\u0022, \u0022app_proto\u0022: \u0022kafka\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 9092, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 66.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 66.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228a8b9112bf8b27f43a6c6f1b05e3b0585dc04772\u0022, \u0022event_fingerprint\u0022: \u0022c474d9c3f8c0776c7c96d4f25d2b0651552d8fad\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 76, \u0022precision_signals\u0022: [\u0022INT-EMAIL-imap-login\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-EMAIL-imap-login\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 66.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 41}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022kafka\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f57d6b1686f6a1148a6a49e52c56940f\u0022, \u0022path_pattern_hash\u0022: \u0022d01bbf3f52d5029936b2dffb0f5e856f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9092, \u0022service\u0022: \u0022kafka\u0022, \u0022service_name\u0022: \u0022kafka\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1110\u0022], \u0022mitre\u0022: \u0022T1110\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bbf25edb2e1c067e0829b8be47edb28d5ac663d7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022port\u0022: 9092, \u0022service\u0022: \u0022kafka\u0022, \u0022service_label_fr\u0022: \u0022KAFKA\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022attack_vector\u0022: \u0022imap bruteforce \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229092 \u00b7 KAFKA\u0022, \u0022emulator_service\u0022: \u0022kafka\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 41\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 66.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 41}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022kafka\u0022, \u0022service_label_fr\u0022: \u0022KAFKA\u0022, \u0022dst_port\u0022: 9092, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-EMAIL-imap-login\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Email Imap Login\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1110\u0022, \u0022mitre_technique\u0022: \u0022T1110\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-kafka\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022port\u0022: 9092, \u0022service\u0022: \u0022kafka\u0022, \u0022service_label_fr\u0022: \u0022KAFKA\u0022}, \u0022attack_vector\u0022: \u0022imap bruteforce \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\\r\\nHost: 62.3.50.33:9092\\r\\nUser-Agent: Go-http-client\/1.1\\r\\nConnection: close\u0022, \u0022target_port_label\u0022: \u00229092 \u00b7 KAFKA\u0022, \u0022emulator_service\u0022: \u0022kafka\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022kafka\u0022, \u0022service_banner\u0022: \u0022honeypot-kafka\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229092\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022imap_probe\u0022, \u0022kafka_api_versions\u0022, \u0022kafka_emulated\u0022, \u0022net_kafka_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022imap_probe\u0022, \u0022kafka_api_versions\u0022, \u0022kafka_emulated\u0022, \u0022net_kafka_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":113},{"id":1810613,"ip":"139.59.210.62","ts":"2026-10-14 22:26:35.000000","proto":"tcp","src_port":44122,"dst_port":23,"service":"telnet","classification":"port_23_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20\u0022, \u0022emulator_response_len\u0022: 45, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022telnet\u0022, \u0022app_proto\u0022: \u0022telnet\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 23, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ee98e358747c5d752a0eb3d3b34c59d0ffe7f883\u0022, \u0022event_fingerprint\u0022: \u002279b983d64b1c5573cc70fb9163374500a6810d67\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022telnet_probe\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00222bb94c377622e6c9a2e704e9148568af\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022attack_vector\u0022: \u0022port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022, \u0022dst_port\u0022: 23, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022attack_vector\u0022: \u0022port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022telnet\u0022, \u0022service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002223\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0}],"total_events":10}