{"ip":"140.245.126.95","exported_at":"2026-10-13T23:29:30+00:00","period_days":30,"metrics":{"events7d":85,"distinct_ports":1,"distinct_classifications":4,"max_severity":8,"last_sensor_id":"paris-1","max_waf_score":14,"max_risk_score":45,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos","IP signal\u00e9e (IPsum, 3 listes ou plus)","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":43,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0001","top_mitre_count":54,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":39},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 nd\bQt\u0014!","protocol_details":{"http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003YK\u01d2@","http_path":"nd\bQt\u0014!","request_line":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003YK\u01d1@ nd\bQt\u0014! HTTP\/1.1","tls_ja3":"af0117bf6433c46885707ad8773fe8cd","tls_ja4":"3720a6c3c91836c1fa696fa194cdc3f3","port":8888,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003YK\u01d2@ nd\bQt\u0014! \u00b7 JA3 af0117bf6433c468 \u00b7 HTTP:8888","evidence_snippet":"\ufffd\ufffdY\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\tnd\ufffd\ufffd\ufffdQ\ufffdt!\r\ufffdJw\ufffd)Y \ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffdl\ufffd`Hhs\ufffd\ufffd\t!6^A\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd","target_port_label":"8888 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffdY\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\tnd\ufffd\ufffd\ufffdQ\ufffdt!\r\ufffdJw\ufffd)Y \ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffdl\ufffd`Hhs\ufffd\ufffd\t!6^A\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"95.126.245.140.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.2","meaning":"IP observ\u00e9e par le honeypot","label":"Slowloris (\u00e9puisement HTTP)"},"events":[{"id":419795,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63162,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003YK\u01d2@","http_target":"nd\bQt\u0014!","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00223b9a55a3dfae348d41860765346a5df22bfc28ce\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d2@\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8949138271217, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022dccc3adab7ae3180b3c771060f6a532612501987\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d3cb3db24b3f1f7b723f4e5c49c2581f\u0022, \u0022path_pattern_hash\u0022: \u0022238d3d7950e8cf1bbe2a002bbf758ae1\u0022, \u0022ja3\u0022: \u0022af0117bf6433c46885707ad8773fe8cd\u0022, \u0022ja4\u0022: \u00223720a6c3c91836c1fa696fa194cdc3f3\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022af0117bf6433c46885707ad8773fe8cd\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-16-35-23-51-10-43-5-11-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00223720a6c3c91836c1fa696fa194cdc3f3\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_b6672bfc6dc6_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d2@\u0022, \u0022path\u0022: \u0022nd\\bQt\\u0014!\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d1@ nd\\bQt\\u0014! HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\\tnd\\b\ufffd\ufffd\ufffdQ\ufffdt\\u0014!\\r\ufffdJw\ufffd)Y \\u0013\ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffd\\u0005l\ufffd`Hhs\ufffd\ufffd\\t!6^A\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d2@\u0022, \u0022path\u0022: \u0022nd\\bQt\\u0014!\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d1@ nd\\bQt\\u0014! HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\\tnd\\b\ufffd\ufffd\ufffdQ\ufffdt\\u0014!\\r\ufffdJw\ufffd)Y \\u0013\ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffd\\u0005l\ufffd`Hhs\ufffd\ufffd\\t!6^A\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 .\ufffd\ufffd\\u001b\ufffd\\u001fA\ufffd\ufffd\u0027\ufffd.T\\u000e\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd}\u0026 \\u00116F\ufffd\ufffdj|\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\\tnd\\b\ufffd\ufffd\ufffdQ\ufffdt\\u0014!\\r\ufffdJw\ufffd)Y \\u0013\ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffd\\u0005l\ufffd`Hhs\ufffd\ufffd\\t!6^A\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224cde9ff4a50fdf8e55344b1a182c5370ec9f086f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d2@\u0022, \u0022http_path\u0022: \u0022nd\\bQt\\u0014!\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d1@ nd\\bQt\\u0014! HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022af0117bf6433c46885707ad8773fe8cd\u0022, \u0022tls_ja4\u0022: \u00223720a6c3c91836c1fa696fa194cdc3f3\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\\tnd\ufffd\ufffd\ufffdQ\ufffdt!\\r\ufffdJw\ufffd)Y \ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffdl\ufffd`Hhs\ufffd\ufffd\\t!6^A\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 nd\\bQt\\u0014!\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d2@\u0022, \u0022http_path\u0022: \u0022nd\\bQt\\u0014!\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003YK\u01d1@ nd\\bQt\\u0014! HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022af0117bf6433c46885707ad8773fe8cd\u0022, \u0022tls_ja4\u0022: \u00223720a6c3c91836c1fa696fa194cdc3f3\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 nd\\bQt\\u0014!\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffd\ufffd\ufffdK\u01d2\ufffd\ufffd@\ufffd\ufffd\ufffd\\tnd\ufffd\ufffd\ufffdQ\ufffdt!\\r\ufffdJw\ufffd)Y \ufffde\ufffdC\ufffd\ufffd%1\u00ec\ufffdE\ufffd\ufffdEh\ufffdl\ufffd`Hhs\ufffd\ufffd\\t!6^A\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"Jw)Y","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419794,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63110,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":":CO\u000f_","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00228f6c8e61bec0f5766a18e814fb59107624af403c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.939851506099763, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u002265faaf945b921373599886e564be22814d7ac7fa\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b4f56338a3ca1a3178cec143ce2651b\u0022, \u0022path_pattern_hash\u0022: \u0022e8a40d34cd98baa5bab75be2b0af6f08\u0022, \u0022ja3\u0022: \u0022b3276dd8fe4974f6cfbdd89b04379d97\u0022, \u0022ja4\u0022: \u0022bb716a6b174256c5e1ff64106f04bfec\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022b3276dd8fe4974f6cfbdd89b04379d97\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-13-35-11-10-5-23-45-43-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022bb716a6b174256c5e1ff64106f04bfec\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_0fbde6205c29_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022:CO\\u000f_\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 :CO\\u000f_ HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd:\ufffd\ufffdC\ufffdO\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd_\ufffd\\u001f\\u0015\ufffd\ufffd\ufffdOC\ufffd\\u0017n n\ufffd\ufffd\u0289\ufffd\ufffd-\\u00199\ufffd\ufffd\/s\ufffd\ufffd\\u001f\\fi`@\ufffd\\u0012\u5983\\u0001g^\ufffdO\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022:CO\\u000f_\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 :CO\\u000f_ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd:\ufffd\ufffdC\ufffdO\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd_\ufffd\\u001f\\u0015\ufffd\ufffd\ufffdOC\ufffd\\u0017n n\ufffd\ufffd\u0289\ufffd\ufffd-\\u00199\ufffd\ufffd\/s\ufffd\ufffd\\u001f\\fi`@\ufffd\\u0012\u5983\\u0001g^\ufffdO\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u01a0\ufffd \ufffd\ufffdY-{\ufffdK\ufffd\ufffdzp\ufffd\ufffd\ufffd\ufffd\ub08aWVl\ufffdy\ufffd7\ufffdJp\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd:\ufffd\ufffdC\ufffdO\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd_\ufffd\\u001f\\u0015\ufffd\ufffd\ufffdOC\ufffd\\u0017n n\ufffd\ufffd\u0289\ufffd\ufffd-\\u00199\ufffd\ufffd\/s\ufffd\ufffd\\u001f\\fi`@\ufffd\\u0012\u5983\\u0001g^\ufffdO\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c88f868dc42b5dd351d7b56cc6360e2694458787\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022:CO\\u000f_\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 :CO\\u000f_ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022b3276dd8fe4974f6cfbdd89b04379d97\u0022, \u0022tls_ja4\u0022: \u0022bb716a6b174256c5e1ff64106f04bfec\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\ufffdC\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffdOC\ufffdn n\ufffd\ufffd\u0289\ufffd\ufffd-9\ufffd\ufffd\/s\ufffd\ufffdi`@\ufffd\u5983g^\ufffdO\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 :CO\\u000f_\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022:CO\\u000f_\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 :CO\\u000f_ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022b3276dd8fe4974f6cfbdd89b04379d97\u0022, \u0022tls_ja4\u0022: \u0022bb716a6b174256c5e1ff64106f04bfec\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 :CO\\u000f_\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\ufffdC\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffdOC\ufffdn n\ufffd\ufffd\u0289\ufffd\ufffd-9\ufffd\ufffd\/s\ufffd\ufffdi`@\ufffd\u5983g^\ufffdO\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0015OC\u0017n","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419793,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63084,"dst_port":8888,"service":"http","classification":"lfi_path_traversal","waf_score":8,"waf_tags":"[\u0022950316:lfi-14\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\u073b\u000e\u0016","http_target":"cb{3i\\\u0022\u0007iW\u0002o","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022303b293028ad5ae0624e526d1b847a19d3159388\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.838442289883371, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022da676bf073f3c4a36cd85bfe934254b8aac4da52\u0022, \u0022event_fingerprint\u0022: \u0022d0b4d4aac7f8325fc394dc5d0c5f017eaa44c503\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022280d2f05d7fee8d1242d31ec3f066d38\u0022, \u0022path_pattern_hash\u0022: \u0022f816e109d8d1f409afba051654e983e2\u0022, \u0022ja3\u0022: \u00229519910d383e90eb6c1bce0afea93ead\u0022, \u0022ja4\u0022: \u00224856b55202e6afa15f24623ee501d1e7\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00229519910d383e90eb6c1bce0afea93ead\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-51-10-35-43-16-13-45-11-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00224856b55202e6afa15f24623ee501d1e7\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_92c5ef77455a_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016\u0022, \u0022path\u0022: \u0022cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016 cb{3i\\\\\\\u0022\\u0007iW\\u0002o HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u073b\\u000e\\u0016\ufffd\\t\ufffd\ufffdcb{\ufffd\ufffd3\ufffd\ufffdi\\\\\\\u0022\\u0007iW\ufffd\ufffd\\u0002o\\u001e\ufffd\\u0013B\ufffd\/ \ufffdv\ufffdjK\ufffd\ufffd0\ufffd\ufffd\\u001eos\ufffd\\u0016\\u0006$\ufffd\ufffd\ufffdb\ufffd\u04a3\ufffd\ufffd\\u0014W\\u000ft-\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u003CZ\ufffd\ufffdf[\\u0018LL\ufffdm\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016\u0022, \u0022path\u0022: \u0022cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016 cb{3i\\\\\\\u0022\\u0007iW\\u0002o HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u073b\\u000e\\u0016\ufffd\\t\ufffd\ufffdcb{\ufffd\ufffd3\ufffd\ufffdi\\\\\\\u0022\\u0007iW\ufffd\ufffd\\u0002o\\u001e\ufffd\\u0013B\ufffd\/ \ufffdv\ufffdjK\ufffd\ufffd0\ufffd\ufffd\\u001eos\ufffd\\u0016\\u0006$\ufffd\ufffd\ufffdb\ufffd\u04a3\ufffd\ufffd\\u0014W\\u000ft-\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u003CZ\ufffd\ufffdf[\\u0018LL\ufffdm\ufffdd\ufffdml\ufffd\\b\\u0002\ufffd\ufffd\ufffd7\ufffd\ufffdc\\u0016\\u0016(\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u073b\\u000e\\u0016\ufffd\\t\ufffd\ufffdcb{\ufffd\ufffd3\ufffd\ufffdi\\\\\\\u0022\\u0007iW\ufffd\ufffd\\u0002o\\u001e\ufffd\\u0013B\ufffd\/ \ufffdv\ufffdjK\ufffd\ufffd0\ufffd\ufffd\\u001eos\ufffd\\u0016\\u0006$\ufffd\ufffd\ufffdb\ufffd\u04a3\ufffd\ufffd\\u0014W\\u000ft-\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u003CZ\ufffd\ufffdf[\\u0018LL\ufffdm\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022576fd0d7edb38e8f9a1620cdc4a26454984c55b6\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016\u0022, \u0022http_path\u0022: \u0022cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016 cb{3i\\\\\\\u0022\\u0007iW\\u0002o HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00229519910d383e90eb6c1bce0afea93ead\u0022, \u0022tls_ja4\u0022: \u00224856b55202e6afa15f24623ee501d1e7\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u073b\ufffd\\t\ufffd\ufffdcb{\ufffd\ufffd3\ufffd\ufffdi\\\\\\\u0022iW\ufffd\ufffdo\ufffdB\ufffd\/ \ufffdv\ufffdjK\ufffd\ufffd0\ufffd\ufffdos\ufffd$\ufffd\ufffd\ufffdb\ufffd\u04a3\ufffd\ufffdWt-\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \u003CZ\ufffd\ufffdf[LL\ufffdm\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-930100-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-930100-sub\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016\u0022, \u0022http_path\u0022: \u0022cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u073b\\u000e\\u0016 cb{3i\\\\\\\u0022\\u0007iW\\u0002o HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00229519910d383e90eb6c1bce0afea93ead\u0022, \u0022tls_ja4\u0022: \u00224856b55202e6afa15f24623ee501d1e7\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 cb{3i\\\\\\\u0022\\u0007iW\\u0002o\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u073b\ufffd\\t\ufffd\ufffdcb{\ufffd\ufffd3\ufffd\ufffdi\\\\\\\u0022iW\ufffd\ufffdo\ufffdB\ufffd\/ \ufffdv\ufffdjK\ufffd\ufffd0\ufffd\ufffdos\ufffd$\ufffd\ufffd\ufffdb\ufffd\u04a3\ufffd\ufffdWt-\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \u003CZ\ufffd\ufffdf[LL\ufffdm\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0013B\/","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":241},{"id":419792,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63042,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003;\u0015","http_target":"\u0011\u010d\u001a\u015box1hoO9","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022702084dd4015447f3f1d9354fd2e0571a2d80bb2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.817680723171128, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022a3ff04fb1069ffd9d35afd3b462c2c382458f123\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fd005e9c4fa493721dd8d55620530219\u0022, \u0022path_pattern_hash\u0022: \u002287a53f9375384a07b294724384c62ce6\u0022, \u0022ja3\u0022: \u0022a8281a28aa674efa3ec70f0e2280aa09\u0022, \u0022ja4\u0022: \u0022ccb2f0c876811d7b284de0a62a7aff98\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022a8281a28aa674efa3ec70f0e2280aa09\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-13-23-16-35-11-5-10-51-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022ccb2f0c876811d7b284de0a62a7aff98\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_8a8d8a6b1c04_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015\u0022, \u0022path\u0022: \u0022\\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015 \\u0011\u010d\\u001a\u015box1hoO9 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003;\\u0015\ufffd\\u001e\ufffd\\u0011\ufffd\u010d\\u001a\ufffd\u015box1h\ufffdoO9\ufffd\ufffd\ufffd\\u000b\ufffdAB\ufffd\ufffd\ufffd\\u0016 \ufffdG\\u0004\\u0006s\/h\ufffd\ufffd\ufffd\\u0018\\u0017\ufffd\\u000e\u0026PW\ufffd\ufffd6\ufffdZR\ufffd\\t\ufffd\\u001c\ufffd\\u0015I\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015\u0022, \u0022path\u0022: \u0022\\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015 \\u0011\u010d\\u001a\u015box1hoO9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003;\\u0015\ufffd\\u001e\ufffd\\u0011\ufffd\u010d\\u001a\ufffd\u015box1h\ufffdoO9\ufffd\ufffd\ufffd\\u000b\ufffdAB\ufffd\ufffd\ufffd\\u0016 \ufffdG\\u0004\\u0006s\/h\ufffd\ufffd\ufffd\\u0018\\u0017\ufffd\\u000e\u0026PW\ufffd\ufffd6\ufffdZR\ufffd\\t\ufffd\\u001c\ufffd\\u0015I\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 bw$V\\u000e]\\u000ef\\u0012jM\/\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd+\\u0019\ufffd\\u001a\\u001e\ufffd3\\u001a\ufffd\u0026?\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003;\\u0015\ufffd\\u001e\ufffd\\u0011\ufffd\u010d\\u001a\ufffd\u015box1h\ufffdoO9\ufffd\ufffd\ufffd\\u000b\ufffdAB\ufffd\ufffd\ufffd\\u0016 \ufffdG\\u0004\\u0006s\/h\ufffd\ufffd\ufffd\\u0018\\u0017\ufffd\\u000e\u0026PW\ufffd\ufffd6\ufffdZR\ufffd\\t\ufffd\\u001c\ufffd\\u0015I\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d508ba0a54d2162f45e8d559c6eac07cf912616f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015\u0022, \u0022http_path\u0022: \u0022\\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015 \\u0011\u010d\\u001a\u015box1hoO9 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022a8281a28aa674efa3ec70f0e2280aa09\u0022, \u0022tls_ja4\u0022: \u0022ccb2f0c876811d7b284de0a62a7aff98\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd;\ufffd\ufffd\ufffd\u010d\ufffd\u015box1h\ufffdoO9\ufffd\ufffd\ufffd\ufffdAB\ufffd\ufffd\ufffd \ufffdGs\/h\ufffd\ufffd\ufffd\ufffd\u0026PW\ufffd\ufffd6\ufffdZR\ufffd\\t\ufffd\ufffdI\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015\u0022, \u0022http_path\u0022: \u0022\\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003;\\u0015 \\u0011\u010d\\u001a\u015box1hoO9 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022a8281a28aa674efa3ec70f0e2280aa09\u0022, \u0022tls_ja4\u0022: \u0022ccb2f0c876811d7b284de0a62a7aff98\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \\u0011\u010d\\u001a\u015box1hoO9\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd;\ufffd\ufffd\ufffd\u010d\ufffd\u015box1h\ufffdoO9\ufffd\ufffd\ufffd\ufffdAB\ufffd\ufffd\ufffd \ufffdGs\/h\ufffd\ufffd\ufffd\ufffd\u0026PW\ufffd\ufffd6\ufffdZR\ufffd\\t\ufffd\ufffdI\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"AB\u0016","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419790,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63060,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003v\u0027\u041d!","http_target":"k","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002213fbd79c3d390e5d6585a21e11ff5ec1970cff0c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003v\u0027\u041d!\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.9802713748102745, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u00221b822029c76900b3dbebccd72b16685afb331fb4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022476aec61a2a07be65b2a23f823e58e54\u0022, \u0022path_pattern_hash\u0022: \u00228254c329a92850f6d539dd376f4816ee\u0022, \u0022ja3\u0022: \u0022e1524b6fe9b776dadbb62e790a884885\u0022, \u0022ja4\u0022: \u0022869e6cd6eb1fffe76e39ac3ee03a3e03\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022e1524b6fe9b776dadbb62e790a884885\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-35-43-5-10-16-45-13-23-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022869e6cd6eb1fffe76e39ac3ee03a3e03\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_d4548f8eaa19_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003v\u0027\u041d!\u0022, \u0022path\u0022: \u0022k\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003V\u0027\u041d! k HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffdv\u0027\u041d\ufffd\ufffd!\\u001e\ufffdk\ufffd\\r\ufffd3\ufffd\ufffdh~\ufffd\u003C\ufffd\ufffd\ufffd\\u0011\u0026\ufffdM8 \ufffd\u055d\ufffd\ufffd;\ufffd\ufffd\\u0010B\ufffdYi\ufffd\ufffdQ\ufffd\ufffdg\ufffd\ufffd9m\\\u0022\u01df\ufffdy\\u0019~\u01ed\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003v\u0027\u041d!\u0022, \u0022path\u0022: \u0022k\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003V\u0027\u041d! k HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffdv\u0027\u041d\ufffd\ufffd!\\u001e\ufffdk\ufffd\\r\ufffd3\ufffd\ufffdh~\ufffd\u003C\ufffd\ufffd\ufffd\\u0011\u0026\ufffdM8 \ufffd\u055d\ufffd\ufffd;\ufffd\ufffd\\u0010B\ufffdYi\ufffd\ufffdQ\ufffd\ufffdg\ufffd\ufffd9m\\\u0022\u01df\ufffdy\\u0019~\u01ed\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 d\ufffd\ufffd\\u0006\u008b\u0704\ufffd\u003C\ufffd\ufffd\ufffd?u\ufffd\/V)9\ufffd\ufffdESFW\ufffd7\ufffd?\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffdv\u0027\u041d\ufffd\ufffd!\\u001e\ufffdk\ufffd\\r\ufffd3\ufffd\ufffdh~\ufffd\u003C\ufffd\ufffd\ufffd\\u0011\u0026\ufffdM8 \ufffd\u055d\ufffd\ufffd;\ufffd\ufffd\\u0010B\ufffdYi\ufffd\ufffdQ\ufffd\ufffdg\ufffd\ufffd9m\\\u0022\u01df\ufffdy\\u0019~\u01ed\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261b5b56ccd35fa08c75ee2bf07e31c8ad9ac3ffb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003v\u0027\u041d!\u0022, \u0022http_path\u0022: \u0022k\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003V\u0027\u041d! k HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022e1524b6fe9b776dadbb62e790a884885\u0022, \u0022tls_ja4\u0022: \u0022869e6cd6eb1fffe76e39ac3ee03a3e03\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdv\u0027\u041d\ufffd\ufffd!\ufffdk\ufffd\\r\ufffd3\ufffd\ufffdh~\ufffd\u003C\ufffd\ufffd\ufffd\u0026\ufffdM8 \ufffd\u055d\ufffd\ufffd;\ufffd\ufffdB\ufffdYi\ufffd\ufffdQ\ufffd\ufffdg\ufffd\ufffd9m\\\u0022\u01df\ufffdy~\u01ed\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 k\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003v\u0027\u041d!\u0022, \u0022http_path\u0022: \u0022k\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003V\u0027\u041d! k HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022e1524b6fe9b776dadbb62e790a884885\u0022, \u0022tls_ja4\u0022: \u0022869e6cd6eb1fffe76e39ac3ee03a3e03\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 k\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdv\u0027\u041d\ufffd\ufffd!\ufffdk\ufffd\\r\ufffd3\ufffd\ufffdh~\ufffd\u003C\ufffd\ufffd\ufffd\u0026\ufffdM8 \ufffd\u055d\ufffd\ufffd;\ufffd\ufffdB\ufffdYi\ufffd\ufffdQ\ufffd\ufffdg\ufffd\ufffd9m\\\u0022\u01df\ufffdy~\u01ed\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"3h~\u003C\u0011\u0026M8","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419786,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63012,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"f[7\u0017","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022d5ffb4447746ef8f6a55b4ffa7533046bdcb4220\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8220435219965925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u002289977fa694f25f6cb8500750dd61bad0aa8f3d55\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222781b62aba40d8c86e8292bcb083b548\u0022, \u0022path_pattern_hash\u0022: \u002265f71fc2ca89ec24b0bcc6e0660249b3\u0022, \u0022ja3\u0022: \u00222f2d93f89362fb0b72e293b0b04837a2\u0022, \u0022ja4\u0022: \u0022ca7e61fc0f6f6d19d7c63ba1d28ebb47\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00222f2d93f89362fb0b72e293b0b04837a2\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-13-35-5-16-23-10-51-11-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022ca7e61fc0f6f6d19d7c63ba1d28ebb47\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_1eebc41352a9_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022f[7\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 f[7\\u0017 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\u001df[7\ufffd\\u0017\ufffd\\u000b\\u0001\ufffd\ufffdi\ufffd5A\ufffd\\u0018bC\ufffd.T\ufffd\u0798\\u0007\ufffd\ufffd \\u0012(*-\ufffd\ufffdE\\u0005\\u001cC\\t\u06a2(f\\u001d\ufffd\u01c1\\u0003\\u001d6\ufffdf\ufffd\\u0014\\u0002R\ufffd\\u000f\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022f[7\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 f[7\\u0017 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\u001df[7\ufffd\\u0017\ufffd\\u000b\\u0001\ufffd\ufffdi\ufffd5A\ufffd\\u0018bC\ufffd.T\ufffd\u0798\\u0007\ufffd\ufffd \\u0012(*-\ufffd\ufffdE\\u0005\\u001cC\\t\u06a2(f\\u001d\ufffd\u01c1\\u0003\\u001d6\ufffdf\ufffd\\u0014\\u0002R\ufffd\\u000f\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 6\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdX:\ufffd\u003C\ufffdg\\u001c9{G\\u0011\ufffd\ufffd\\bfX\ufffdy\ufffd,\ufffd\ufffd\ufffdD\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\u001df[7\ufffd\\u0017\ufffd\\u000b\\u0001\ufffd\ufffdi\ufffd5A\ufffd\\u0018bC\ufffd.T\ufffd\u0798\\u0007\ufffd\ufffd \\u0012(*-\ufffd\ufffdE\\u0005\\u001cC\\t\u06a2(f\\u001d\ufffd\u01c1\\u0003\\u001d6\ufffdf\ufffd\\u0014\\u0002R\ufffd\\u000f\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227a54d47cd5852dabd1d252f3cf1d182a1be117a3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022f[7\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 f[7\\u0017 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222f2d93f89362fb0b72e293b0b04837a2\u0022, \u0022tls_ja4\u0022: \u0022ca7e61fc0f6f6d19d7c63ba1d28ebb47\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf[7\ufffd\ufffd\ufffd\ufffdi\ufffd5A\ufffdbC\ufffd.T\ufffd\u0798\ufffd\ufffd (*-\ufffd\ufffdEC\\t\u06a2(f\ufffd\u01c16\ufffdf\ufffdR\ufffd\\\\\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 f[7\\u0017\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022f[7\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 f[7\\u0017 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222f2d93f89362fb0b72e293b0b04837a2\u0022, \u0022tls_ja4\u0022: \u0022ca7e61fc0f6f6d19d7c63ba1d28ebb47\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 f[7\\u0017\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf[7\ufffd\ufffd\ufffd\ufffdi\ufffd5A\ufffdbC\ufffd.T\ufffd\u0798\ufffd\ufffd (*-\ufffd\ufffdEC\\t\u06a2(f\ufffd\u01c16\ufffdf\ufffdR\ufffd\\\\\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0001i5A\u0018bC.T\u0798\u0007","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419785,"ip":"140.245.126.95","ts":"2026-10-12 12:49:08.000000","proto":"tcp","src_port":63028,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\u0004","http_target":"O\u000e[9","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022eb6a574c0fc6b33a1b94f7dc14b46fa31214cf86\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.855935000967284, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u002225f2ebddcfb12534039085f71c05c866fb9cabc5\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002204d8c7ff436f6e813f1c141ba54f40ce\u0022, \u0022path_pattern_hash\u0022: \u0022099db3a86980be2760ff715b98583ae5\u0022, \u0022ja3\u0022: \u0022facadef287eac396dfbc89d0bcbf8d30\u0022, \u0022ja4\u0022: \u0022ff490e0fe54bfe778410783c025c7039\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022facadef287eac396dfbc89d0bcbf8d30\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-16-13-35-5-45-11-43-51-23,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022ff490e0fe54bfe778410783c025c7039\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_2b8bfa7c30b5_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004\u0022, \u0022path\u0022: \u0022O\\u000e[9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004 O\\u000e[9 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0004\\tO\ufffd\\u000e[\ufffd9\\u000b-3\u0541\ufffde\ufffd~\ufffd#\ufffd\ufffd\ufffd-6\ufffd\\u0002 \ufffdI\ufffdA \ufffderd\ufffd\ufffd\\u001a\ufffd\ufffd\ufffdV\\u000f\ufffd\ufffd\\u0016VpX\\ry\ufffd\u0552\ufffd\ufffd\ufffdi\ufffdp\ufffd\ufffd \\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004\u0022, \u0022path\u0022: \u0022O\\u000e[9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004 O\\u000e[9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0004\\tO\ufffd\\u000e[\ufffd9\\u000b-3\u0541\ufffde\ufffd~\ufffd#\ufffd\ufffd\ufffd-6\ufffd\\u0002 \ufffdI\ufffdA \ufffderd\ufffd\ufffd\\u001a\ufffd\ufffd\ufffdV\\u000f\ufffd\ufffd\\u0016VpX\\ry\ufffd\u0552\ufffd\ufffd\ufffdi\ufffdp\ufffd\ufffd \\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd|\\u0012\ufffd\/\ufffda_a\ufffd\u003CK\ufffd\\u0018\ufffd\ufffd\ufffd\ufffd\u031d\ufffde\ufffdxtv\ufffd\\f\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0004\\tO\ufffd\\u000e[\ufffd9\\u000b-3\u0541\ufffde\ufffd~\ufffd#\ufffd\ufffd\ufffd-6\ufffd\\u0002 \ufffdI\ufffdA \ufffderd\ufffd\ufffd\\u001a\ufffd\ufffd\ufffdV\\u000f\ufffd\ufffd\\u0016VpX\\ry\ufffd\u0552\ufffd\ufffd\ufffdi\ufffdp\ufffd\ufffd \\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002291af3e493204c247050bbcff51902418487d0dd7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004\u0022, \u0022http_path\u0022: \u0022O\\u000e[9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004 O\\u000e[9 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022facadef287eac396dfbc89d0bcbf8d30\u0022, \u0022tls_ja4\u0022: \u0022ff490e0fe54bfe778410783c025c7039\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\tO\ufffd[\ufffd9-3\u0541\ufffde\ufffd~\ufffd#\ufffd\ufffd\ufffd-6\ufffd \ufffdI\ufffdA \ufffderd\ufffd\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdVpX\\ry\ufffd\u0552\ufffd\ufffd\ufffdi\ufffdp\ufffd\ufffd \ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n\\thttp\/1.\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 O\\u000e[9\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004\u0022, \u0022http_path\u0022: \u0022O\\u000e[9\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0004 O\\u000e[9 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022facadef287eac396dfbc89d0bcbf8d30\u0022, \u0022tls_ja4\u0022: \u0022ff490e0fe54bfe778410783c025c7039\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 O\\u000e[9\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\tO\ufffd[\ufffd9-3\u0541\ufffde\ufffd~\ufffd#\ufffd\ufffd\ufffd-6\ufffd \ufffdI\ufffdA \ufffderd\ufffd\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdVpX\\ry\ufffd\u0552\ufffd\ufffd\ufffdi\ufffdp\ufffd\ufffd \ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n\\thttp\/1.\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"-3\u0541e~#-6\u0002","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419781,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62952,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\u003CG\u0666\u0019","http_target":"3\u0014\u022cv","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002222c219bc378143bc84d2d3364c24e4a1a84580f9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8424033622584055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u002232fe06d2b27bf5e6ca6f88b7534457196d0b3ef2\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224957806afad0cb62666dfeed00c5735e\u0022, \u0022path_pattern_hash\u0022: \u00221e0bdbf9f693fe5d9a1a7c35ae09ffae\u0022, \u0022ja3\u0022: \u002236ea5bdad136cb593dda5fb1fdc5de44\u0022, \u0022ja4\u0022: \u00225d52398658ff9903f7e22d705adc775d\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u002236ea5bdad136cb593dda5fb1fdc5de44\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-45-51-11-10-43-5-13-23-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00225d52398658ff9903f7e22d705adc775d\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_93dc6397aebe_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019\u0022, \u0022path\u0022: \u00223\\u0014\u022cv\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019 3\\u0014\u022cv HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u003CG\u0666\\u0019\\u001e\ufffd\ufffd\\f3\\u0014\u022cv\\u001c\ufffd\ufffd\ufffd\\u0019d\ufffd\ufffdMrN\ufffd\ufffdx\ufffd 5\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\\u000b\ufffd` \\u000f\ufffd\ufffd\ufffd1\ufffd\\u0013\\u000f\ufffd-\\u0017\\rEK\ufffdc\\b\ufffdH\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\ufffd}(\ufffd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019\u0022, \u0022path\u0022: \u00223\\u0014\u022cv\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019 3\\u0014\u022cv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u003CG\u0666\\u0019\\u001e\ufffd\ufffd\\f3\\u0014\u022cv\\u001c\ufffd\ufffd\ufffd\\u0019d\ufffd\ufffdMrN\ufffd\ufffdx\ufffd 5\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\\u000b\ufffd` \\u000f\ufffd\ufffd\ufffd1\ufffd\\u0013\\u000f\ufffd-\\u0017\\rEK\ufffdc\\b\ufffdH\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\ufffd}(\ufffd\\u0019[\ufffdy(\ufffd)N\ufffd\ufffd\\u0011\\u0002Z\ufffd\u003Eo\ufffd\ufffd\\u000b_\\u0011i\ufffd\\u0002\\u000f\\n\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u003CG\u0666\\u0019\\u001e\ufffd\ufffd\\f3\\u0014\u022cv\\u001c\ufffd\ufffd\ufffd\\u0019d\ufffd\ufffdMrN\ufffd\ufffdx\ufffd 5\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\\u000b\ufffd` \\u000f\ufffd\ufffd\ufffd1\ufffd\\u0013\\u000f\ufffd-\\u0017\\rEK\ufffdc\\b\ufffdH\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\ufffd}(\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d9256a962bb41b189913e7617e238de27e8ea965\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019\u0022, \u0022http_path\u0022: \u00223\\u0014\u022cv\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019 3\\u0014\u022cv HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u002236ea5bdad136cb593dda5fb1fdc5de44\u0022, \u0022tls_ja4\u0022: \u00225d52398658ff9903f7e22d705adc775d\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\u003CG\u0666\ufffd\ufffd3\u022cv\ufffd\ufffd\ufffdd\ufffd\ufffdMrN\ufffd\ufffdx\ufffd 5\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffd1\ufffd\ufffd-\\rEK\ufffdc\ufffdH\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-3\u0026$ \ufffd\ufffd\ufffd}(\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 3\\u0014\u022cv\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019\u0022, \u0022http_path\u0022: \u00223\\u0014\u022cv\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u003CG\u0666\\u0019 3\\u0014\u022cv HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u002236ea5bdad136cb593dda5fb1fdc5de44\u0022, \u0022tls_ja4\u0022: \u00225d52398658ff9903f7e22d705adc775d\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 3\\u0014\u022cv\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\u003CG\u0666\ufffd\ufffd3\u022cv\ufffd\ufffd\ufffdd\ufffd\ufffdMrN\ufffd\ufffdx\ufffd 5\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffd1\ufffd\ufffd-\\rEK\ufffdc\ufffdH\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-3\u0026$ \ufffd\ufffd\ufffd}(\ufffd\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0019dMrNx","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419780,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62924,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"C\u000e","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00226f8712954a17502d807292c9abab06357f45c265\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.845294922474253, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u00225f6ed4c4f7999102f3890615be0fb769555cbba5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223648e80a384840ac670bb023a2dac6ca\u0022, \u0022path_pattern_hash\u0022: \u0022b8fe66238992524508c6d11abe8a8838\u0022, \u0022ja3\u0022: \u0022e3c3eda2e03c49f6d670e1cdf2af5e0e\u0022, \u0022ja4\u0022: \u0022458737a4cf11b7c034142970f6c74ff0\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022e3c3eda2e03c49f6d670e1cdf2af5e0e\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-13-23-10-51-43-16-11-35,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022458737a4cf11b7c034142970f6c74ff0\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_22f7bbe5adec_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022C\\u000e\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 C\\u000e HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\r\ufffdC\\u000e\\rMI\\u001e\ufffdw\ufffd0\\u0015\ufffd\ufffd\ufffd*N\\\u0022\\u0016\ufffdc\ufffd\ufffd\ufffd\ufffd%EO\ufffd\ufffd T\ufffd\\u000e\ufffd\\u0007\u0027\ufffdS\ufffd\ufffd\\u0013\ufffd1\ufffd\ufffd\ufffd\ufffdQg1Q\u003C\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022C\\u000e\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 C\\u000e HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\r\ufffdC\\u000e\\rMI\\u001e\ufffdw\ufffd0\\u0015\ufffd\ufffd\ufffd*N\\\u0022\\u0016\ufffdc\ufffd\ufffd\ufffd\ufffd%EO\ufffd\ufffd T\ufffd\\u000e\ufffd\\u0007\u0027\ufffdS\ufffd\ufffd\\u0013\ufffd1\ufffd\ufffd\ufffd\ufffdQg1Q\u003C\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u001f\ufffd\ufffd\\\u0022\ufffd#\ufffdo\ufffd=\ufffdh\ufffdt\u04fe\ufffd\ufffd\\b\ufffd[\ufffd\ufffd\ufffd\ufffdt\\u0010%\u003E\ufffd}t\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\r\ufffdC\\u000e\\rMI\\u001e\ufffdw\ufffd0\\u0015\ufffd\ufffd\ufffd*N\\\u0022\\u0016\ufffdc\ufffd\ufffd\ufffd\ufffd%EO\ufffd\ufffd T\ufffd\\u000e\ufffd\\u0007\u0027\ufffdS\ufffd\ufffd\\u0013\ufffd1\ufffd\ufffd\ufffd\ufffdQg1Q\u003C\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022353879563318237802bc98043b81cbd4de882575\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022C\\u000e\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 C\\u000e HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022e3c3eda2e03c49f6d670e1cdf2af5e0e\u0022, \u0022tls_ja4\u0022: \u0022458737a4cf11b7c034142970f6c74ff0\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\r\ufffdC\\rMI\ufffdw\ufffd0\ufffd\ufffd\ufffd*N\\\u0022\ufffdc\ufffd\ufffd\ufffd\ufffd%EO\ufffd\ufffd T\ufffd\ufffd\u0027\ufffdS\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffdQg1Q\u003C\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd)\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 C\\u000e\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022C\\u000e\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 C\\u000e HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022e3c3eda2e03c49f6d670e1cdf2af5e0e\u0022, \u0022tls_ja4\u0022: \u0022458737a4cf11b7c034142970f6c74ff0\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 C\\u000e\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\r\ufffdC\\rMI\ufffdw\ufffd0\ufffd\ufffd\ufffd*N\\\u0022\ufffdc\ufffd\ufffd\ufffd\ufffd%EO\ufffd\ufffd T\ufffd\ufffd\u0027\ufffdS\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffdQg1Q\u003C\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd)\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"MI","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419779,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62950,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"cxV]q2","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022c6c3cf28cf0b9e496eb9e761e2256a8fda15f44f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.937572229351962, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022e90fef90c4a4937ec6ab083d5083a14e12bfb261\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ddb39533e99c41119e08958499a2dd46\u0022, \u0022path_pattern_hash\u0022: \u0022bd07cfa13ecd5c98b4d281cfea4c470c\u0022, \u0022ja3\u0022: \u0022b138543b8924e49c312f6f2e96e7cd6a\u0022, \u0022ja4\u0022: \u0022e6e6d4c7f093d968067fc7d91d1cebe5\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022b138543b8924e49c312f6f2e96e7cd6a\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-10-23-13-45-11-43-51-16-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022e6e6d4c7f093d968067fc7d91d1cebe5\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_80b794fa1d8b_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022cxV]q2\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 cxV]q2 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\f\ufffdcx\ufffd\ufffdV]q\ufffd\ufffd\ufffd\ufffd2\\fq\u042fZu\ufffd\ufffd,\ufffd0 \ufffd\ufffd4\\u0004\ufffd x\ufffd\ufffd=\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd;\ufffdu\ufffd8\u0514\ufffd\ufffd\\u001e\ufffd\ufffd\\u000b!\ufffdH\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022cxV]q2\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 cxV]q2 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\f\ufffdcx\ufffd\ufffdV]q\ufffd\ufffd\ufffd\ufffd2\\fq\u042fZu\ufffd\ufffd,\ufffd0 \ufffd\ufffd4\\u0004\ufffd x\ufffd\ufffd=\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd;\ufffdu\ufffd8\u0514\ufffd\ufffd\\u001e\ufffd\ufffd\\u000b!\ufffdH\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\n3\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffdt%\\u0005\ufffdI\\u001f\ufffd\\u0005\ufffd\/\ufffd\ufffd%\ufffd\ufffd\\u001f\u003E\ufffd3\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\f\ufffdcx\ufffd\ufffdV]q\ufffd\ufffd\ufffd\ufffd2\\fq\u042fZu\ufffd\ufffd,\ufffd0 \ufffd\ufffd4\\u0004\ufffd x\ufffd\ufffd=\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd;\ufffdu\ufffd8\u0514\ufffd\ufffd\\u001e\ufffd\ufffd\\u000b!\ufffdH\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022737f549c561a2bf301ec3795036632261535d070\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022cxV]q2\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 cxV]q2 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022b138543b8924e49c312f6f2e96e7cd6a\u0022, \u0022tls_ja4\u0022: \u0022e6e6d4c7f093d968067fc7d91d1cebe5\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdcx\ufffd\ufffdV]q\ufffd\ufffd\ufffd\ufffd2q\u042fZu\ufffd\ufffd,\ufffd0 \ufffd\ufffd4\ufffd x\ufffd\ufffd=\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd;\ufffdu\ufffd8\u0514\ufffd\ufffd\ufffd\ufffd!\ufffdH\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 cxV]q2\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022cxV]q2\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 cxV]q2 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022b138543b8924e49c312f6f2e96e7cd6a\u0022, \u0022tls_ja4\u0022: \u0022e6e6d4c7f093d968067fc7d91d1cebe5\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 cxV]q2\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdcx\ufffd\ufffdV]q\ufffd\ufffd\ufffd\ufffd2q\u042fZu\ufffd\ufffd,\ufffd0 \ufffd\ufffd4\ufffd x\ufffd\ufffd=\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd;\ufffdu\ufffd8\u0514\ufffd\ufffd\ufffd\ufffd!\ufffdH\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"q\u042fZu,0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419778,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62908,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003{0!!3~\u0022","http_target":"s","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022a0f1490a20d0211c997b44bc357e1972deab8ae3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.943919763325265, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u002284b62104d8bf1282182c03f2e4ec80ed5b16fa3a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002281359e8181a48ac5f15eaac8fdbbf529\u0022, \u0022path_pattern_hash\u0022: \u0022043a718774c572bd8a25adbeb1bfcd5c\u0022, \u0022ja3\u0022: \u00222e52fe32b1a9051e3fb562988563e7a5\u0022, \u0022ja4\u0022: \u002291dbb794bae19833dd8cf4fe92cd3d83\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00222e52fe32b1a9051e3fb562988563e7a5\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-35-16-13-45-43-23-5-10-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002291dbb794bae19833dd8cf4fe92cd3d83\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_26aad6a7f0f0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022\u0022, \u0022path\u0022: \u0022s\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022 s HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd{0\ufffd!!\ufffd3\ufffd~\ufffd\\\u0022\ufffd\ufffd\\ts\ufffd\\u001e\ufffd\ufffdR\ufffdA\ufffd\\u0017=5\ufffd\ufffd\\n T\ufffd\ufffdo\\u001bu\\b\\u0011\ufffd%+.\ufffd\ufffd\ufffd\ufffdg\ufffdb\ufffd\ufffde\\t^\ufffd2\ufffd\ufffd\ufffdC\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022\u0022, \u0022path\u0022: \u0022s\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022 s HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd{0\ufffd!!\ufffd3\ufffd~\ufffd\\\u0022\ufffd\ufffd\\ts\ufffd\\u001e\ufffd\ufffdR\ufffdA\ufffd\\u0017=5\ufffd\ufffd\\n T\ufffd\ufffdo\\u001bu\\b\\u0011\ufffd%+.\ufffd\ufffd\ufffd\ufffdg\ufffdb\ufffd\ufffde\\t^\ufffd2\ufffd\ufffd\ufffdC\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\u0001C\ufffd\ufffdS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0560\ufffdtNPA\ufffd\\u0010[\ufffdJ\ufffd\ufffd\ufffdel\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd{0\ufffd!!\ufffd3\ufffd~\ufffd\\\u0022\ufffd\ufffd\\ts\ufffd\\u001e\ufffd\ufffdR\ufffdA\ufffd\\u0017=5\ufffd\ufffd\\n T\ufffd\ufffdo\\u001bu\\b\\u0011\ufffd%+.\ufffd\ufffd\ufffd\ufffdg\ufffdb\ufffd\ufffde\\t^\ufffd2\ufffd\ufffd\ufffdC\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a03694fc280b830ea14d012fa058eedde1a71b30\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022\u0022, \u0022http_path\u0022: \u0022s\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022 s HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222e52fe32b1a9051e3fb562988563e7a5\u0022, \u0022tls_ja4\u0022: \u002291dbb794bae19833dd8cf4fe92cd3d83\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd{0\ufffd!!\ufffd3\ufffd~\ufffd\\\u0022\ufffd\ufffd\\ts\ufffd\ufffd\ufffdR\ufffdA\ufffd=5\ufffd\ufffd\\n T\ufffd\ufffdou\ufffd%+.\ufffd\ufffd\ufffd\ufffdg\ufffdb\ufffd\ufffde\\t^\ufffd2\ufffd\ufffd\ufffdC\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 s\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022\u0022, \u0022http_path\u0022: \u0022s\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003{0!!3~\\\u0022 s HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222e52fe32b1a9051e3fb562988563e7a5\u0022, \u0022tls_ja4\u0022: \u002291dbb794bae19833dd8cf4fe92cd3d83\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 s\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd{0\ufffd!!\ufffd3\ufffd~\ufffd\\\u0022\ufffd\ufffd\\ts\ufffd\ufffd\ufffdR\ufffdA\ufffd=5\ufffd\ufffd\\n T\ufffd\ufffdou\ufffd%+.\ufffd\ufffd\ufffd\ufffdg\ufffdb\ufffd\ufffde\\t^\ufffd2\ufffd\ufffd\ufffdC\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"RA\u0017=5","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419777,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62894,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003k$_\u0000\u0011W","http_target":"\u003Ep\u0017?5a\u0018\u02a3","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 1, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022fd107c6ebee545560f7d8c894d1043f6f0e3ba6f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003k$_\\u0000\\u0011W\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.852601231336574, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u0022f1a3ea10329447b5afe4221d771984d5286574c1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f1d5eb14448d3e27f30f19cbb210202b\u0022, \u0022path_pattern_hash\u0022: \u0022a7a7c3b589bc968fe838a8b5d2230c59\u0022, \u0022ja3\u0022: \u0022ed326213d47a8194bb031efdaee55e23\u0022, \u0022ja4\u0022: \u0022693473ee641b54d8c0c9b8dde38cd1ff\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022ed326213d47a8194bb031efdaee55e23\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-16-11-35-10-13-23-51-5-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022693473ee641b54d8c0c9b8dde38cd1ff\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_d9afbef3f4ed_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003k$_\\u0000\\u0011W\u0022, \u0022path\u0022: \u0022\u003Ep\\u0017\u0022, \u0022query_string\u0022: \u00225a\\u0018\u02a3\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003K$_\\u0000\\u0011W \u003Ep\\u0017?5a\\u0018\u02a3 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdk\ufffd$_\ufffd\ufffd\\u0000\ufffd\ufffd\\u0011W\ufffd\ufffd\\u001f\u003Ep\ufffd\\u0017\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffda\\u0018\u02a3 ~\ufffd?\ufffd\ufffd\\f\ufffd\ufffd%\\n_|\ufffd\ufffd#\ufffd5\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\\u0002L\\u0010\ufffd?\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003k$_\\u0000\\u0011W\u0022, \u0022path\u0022: \u0022\u003Ep\\u0017\u0022, \u0022query_string\u0022: \u00225a\\u0018\u02a3\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003K$_\\u0000\\u0011W \u003Ep\\u0017?5a\\u0018\u02a3 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdk\ufffd$_\ufffd\ufffd\\u0000\ufffd\ufffd\\u0011W\ufffd\ufffd\\u001f\u003Ep\ufffd\\u0017\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffda\\u0018\u02a3 ~\ufffd?\ufffd\ufffd\\f\ufffd\ufffd%\\n_|\ufffd\ufffd#\ufffd5\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\\u0002L\\u0010\ufffd?\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdPQ=\\u0002\ufffd\ufffd\ufffdDN\ufffd\ufffd5\\f!\ufffdJ\ufffd\ufffd\\u0007\ufffd\\u0001\ufffdQ\ufffdpg\ufffd\ufffdaV\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdk\ufffd$_\ufffd\ufffd\\u0000\ufffd\ufffd\\u0011W\ufffd\ufffd\\u001f\u003Ep\ufffd\\u0017\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffda\\u0018\u02a3 ~\ufffd?\ufffd\ufffd\\f\ufffd\ufffd%\\n_|\ufffd\ufffd#\ufffd5\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\\u0002L\\u0010\ufffd?\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225a522bb0192270765d0022dfa78745fe632883d7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003k$_\\u0000\\u0011W\u0022, \u0022http_path\u0022: \u0022\u003Ep\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003K$_\\u0000\\u0011W \u003Ep\\u0017?5a\\u0018\u02a3 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022ed326213d47a8194bb031efdaee55e23\u0022, \u0022tls_ja4\u0022: \u0022693473ee641b54d8c0c9b8dde38cd1ff\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdk\ufffd$_\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\u003Ep\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffda\u02a3 ~\ufffd?\ufffd\ufffd\ufffd\ufffd%\\n_|\ufffd\ufffd#\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\ufffd\ufffdL\ufffd?\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \u003Ep\\u0017\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003k$_\\u0000\\u0011W\u0022, \u0022http_path\u0022: \u0022\u003Ep\\u0017\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003K$_\\u0000\\u0011W \u003Ep\\u0017?5a\\u0018\u02a3 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022ed326213d47a8194bb031efdaee55e23\u0022, \u0022tls_ja4\u0022: \u0022693473ee641b54d8c0c9b8dde38cd1ff\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \u003Ep\\u0017\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdk\ufffd$_\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\u003Ep\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffda\u02a3 ~\ufffd?\ufffd\ufffd\ufffd\ufffd%\\n_|\ufffd\ufffd#\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\ufffd\ufffdL\ufffd?\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"~?","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419776,"ip":"140.245.126.95","ts":"2026-10-12 12:49:07.000000","proto":"tcp","src_port":62912,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"2H#]\u0012","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002285db3a7bbfbec7b6fb05b9c71a95617db8febf92\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.880002507439401, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022203eab03bc3444b240dd5f31f57aaf728271fc85\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0768\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229d8e6a77c9ce2d0f04f54538c339c0cf\u0022, \u0022path_pattern_hash\u0022: \u002263ffa4b542779f194daef60c95779af5\u0022, \u0022ja3\u0022: \u0022f3d741d99c849d4dc3e6fb93e3058399\u0022, \u0022ja4\u0022: \u0022868498aa1a240dc4858ce22db9c1ff03\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022f3d741d99c849d4dc3e6fb93e3058399\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-35-16-43-10-13-23-51-11-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022868498aa1a240dc4858ce22db9c1ff03\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_bcd823372d64_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u00222H#]\\u0012\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 2H#]\\u0012 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001c2\ufffdH\ufffd#\ufffd\ufffd]\\u0012\\u001e\\u00029\ufffd\\u001a\ufffd\\\u0022\ufffd\ufffdf?\ufffd\\u0017\ufffdxo\ufffd([\\u0006\ufffd \ufffd\\u0014%\ufffd\\t\ufffd6\u0734Du\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd{\\u001b\ufffd\ufffdfx]d\u0552#\ufffdZG\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u00222H#]\\u0012\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 2H#]\\u0012 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001c2\ufffdH\ufffd#\ufffd\ufffd]\\u0012\\u001e\\u00029\ufffd\\u001a\ufffd\\\u0022\ufffd\ufffdf?\ufffd\\u0017\ufffdxo\ufffd([\\u0006\ufffd \ufffd\\u0014%\ufffd\\t\ufffd6\u0734Du\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd{\\u001b\ufffd\ufffdfx]d\u0552#\ufffdZG\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\u0004\ufffdS\\\u0022\ufffd\u02d1H\ufffd[\ufffd\ufffdn\u05a1\ufffd%\ufffdws)\ufffd\ufffd\ufffd$\ufffd0\ufffd\ufffd\u003C\\u000f\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001c2\ufffdH\ufffd#\ufffd\ufffd]\\u0012\\u001e\\u00029\ufffd\\u001a\ufffd\\\u0022\ufffd\ufffdf?\ufffd\\u0017\ufffdxo\ufffd([\\u0006\ufffd \ufffd\\u0014%\ufffd\\t\ufffd6\u0734Du\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd{\\u001b\ufffd\ufffdfx]d\u0552#\ufffdZG\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cb1ad29a9747b47477bc5460a4055d80fe58aace\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u00222H#]\\u0012\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 2H#]\\u0012 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022f3d741d99c849d4dc3e6fb93e3058399\u0022, \u0022tls_ja4\u0022: \u0022868498aa1a240dc4858ce22db9c1ff03\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd2\ufffdH\ufffd#\ufffd\ufffd]9\ufffd\ufffd\\\u0022\ufffd\ufffdf?\ufffd\ufffdxo\ufffd([\ufffd \ufffd%\ufffd\\t\ufffd6\u0734Du\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd{\ufffd\ufffdfx]d\u0552#\ufffdZG\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 2H#]\\u0012\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0768\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0768\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u00222H#]\\u0012\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 2H#]\\u0012 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022f3d741d99c849d4dc3e6fb93e3058399\u0022, \u0022tls_ja4\u0022: \u0022868498aa1a240dc4858ce22db9c1ff03\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 2H#]\\u0012\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd2\ufffdH\ufffd#\ufffd\ufffd]9\ufffd\ufffd\\\u0022\ufffd\ufffdf?\ufffd\ufffdxo\ufffd([\ufffd \ufffd%\ufffd\\t\ufffd6\u0734Du\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd{\ufffd\ufffdfx]d\u0552#\ufffdZG\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u00029\u001a\u0022f?\u0017xo([\u0006","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419473,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45686,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003IK","http_target":"V4t\u0006z2\u039e\u003C\u0015","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022f8c92f072070d0cd9649c6d1ab7626a2254bada4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.806771219091912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u00220c4859f12069eb0fe403730adc2c2af8fe89b861\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022962eaef08735f5536f3c55460080ca0f\u0022, \u0022path_pattern_hash\u0022: \u0022598bc9f5721231c8cded54fc1f52a89d\u0022, \u0022ja3\u0022: \u0022fb6539963f2f540a5f3ea2aece53135d\u0022, \u0022ja4\u0022: \u0022b9077b5703a0cc20c710c8da9cf5bf35\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022fb6539963f2f540a5f3ea2aece53135d\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-43-10-23-16-51-5-13-45-11,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022b9077b5703a0cc20c710c8da9cf5bf35\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_9e4b01089721_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK\u0022, \u0022path\u0022: \u0022V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK V4t\\u0006z2\u039e\u003C\\u0015 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003I\ufffd\ufffdK\\nV4t\ufffd\\u0006z2\ufffd\u039e\ufffd\u003C\\u0015\\u000b\ufffd\ufffd\\u0017=\u003C\\u0014\ufffd\\u001a\\u001c\ufffd\ufffd\ufffd h\ufffd\ufffd42\ufffdj\\r\ufffd\ufffd\ufffdRA\\n\ufffd\ufffd\ufffd\u003C\ufffd \\b\ufffd\u043a\ufffdP]3\\u000f\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK\u0022, \u0022path\u0022: \u0022V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK V4t\\u0006z2\u039e\u003C\\u0015 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003I\ufffd\ufffdK\\nV4t\ufffd\\u0006z2\ufffd\u039e\ufffd\u003C\\u0015\\u000b\ufffd\ufffd\\u0017=\u003C\\u0014\ufffd\\u001a\\u001c\ufffd\ufffd\ufffd h\ufffd\ufffd42\ufffdj\\r\ufffd\ufffd\ufffdRA\\n\ufffd\ufffd\ufffd\u003C\ufffd \\b\ufffd\u043a\ufffdP]3\\u000f\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\\u0016\u06bd\\u0007e\ufffd\u4754a#\ufffdo\ufffd\ufffd\\u0012B\ufffd;\\u000b\\u000b\ufffd\\u001f\\t\ufffdyh\\u0004\ufffdl\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003I\ufffd\ufffdK\\nV4t\ufffd\\u0006z2\ufffd\u039e\ufffd\u003C\\u0015\\u000b\ufffd\ufffd\\u0017=\u003C\\u0014\ufffd\\u001a\\u001c\ufffd\ufffd\ufffd h\ufffd\ufffd42\ufffdj\\r\ufffd\ufffd\ufffdRA\\n\ufffd\ufffd\ufffd\u003C\ufffd \\b\ufffd\u043a\ufffdP]3\\u000f\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022632c3b1954e2960106886e16e0aa58ef271e6eeb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK\u0022, \u0022http_path\u0022: \u0022V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK V4t\\u0006z2\u039e\u003C\\u0015 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022fb6539963f2f540a5f3ea2aece53135d\u0022, \u0022tls_ja4\u0022: \u0022b9077b5703a0cc20c710c8da9cf5bf35\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdI\ufffd\ufffdK\\nV4t\ufffdz2\ufffd\u039e\ufffd\u003C\ufffd\ufffd=\u003C\ufffd\ufffd\ufffd\ufffd h\ufffd\ufffd42\ufffdj\\r\ufffd\ufffd\ufffdRA\\n\ufffd\ufffd\ufffd\u003C\ufffd \ufffd\u043a\ufffdP]3\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK\u0022, \u0022http_path\u0022: \u0022V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003IK V4t\\u0006z2\u039e\u003C\\u0015 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022fb6539963f2f540a5f3ea2aece53135d\u0022, \u0022tls_ja4\u0022: \u0022b9077b5703a0cc20c710c8da9cf5bf35\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 V4t\\u0006z2\u039e\u003C\\u0015\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdI\ufffd\ufffdK\\nV4t\ufffdz2\ufffd\u039e\ufffd\u003C\ufffd\ufffd=\u003C\ufffd\ufffd\ufffd\ufffd h\ufffd\ufffd42\ufffdj\\r\ufffd\ufffd\ufffdRA\\n\ufffd\ufffd\ufffd\u003C\ufffd \ufffd\u043a\ufffdP]3\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0017=\u003C\u0014\u001a","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419468,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45620,"dst_port":8888,"service":"http","classification":"lfi_path_traversal","waf_score":8,"waf_tags":"[\u0022950316:lfi-14\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003ure#","http_target":"0t\\:cA}5[","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002272497aafc029723ed70a8595b3104ec01819cb4a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003ure#\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.9008305157740635, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022da676bf073f3c4a36cd85bfe934254b8aac4da52\u0022, \u0022event_fingerprint\u0022: \u0022e1279af5026d471c29b74104db08a8c658dc78e8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002209e64b4d5a55def0ef2962d8fe2398fc\u0022, \u0022path_pattern_hash\u0022: \u00225ddd199ebae1fef461371721b997ab45\u0022, \u0022ja3\u0022: \u00227e29fe4d8b0d0da519f4a53161c44c85\u0022, \u0022ja4\u0022: \u002213793626f6e8ff10d9c97730ca3759ea\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00227e29fe4d8b0d0da519f4a53161c44c85\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-51-23-45-11-35-10-5-13-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002213793626f6e8ff10d9c97730ca3759ea\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_94e6a8222c2f_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003ure#\u0022, \u0022path\u0022: \u00220t\\\\:cA}5[\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003URE# 0t\\\\:cA}5[ HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003ure# 0t\ufffd\\\\:\ufffdcA}5\ufffd[\\n\\u0018;\ufffd\ufffd{[\\u0012\ufffdE\ufffd\ufffd\ufffd\ufffd] HWx\ufffd\\ff\ufffd;\ufffd8\ufffd\ufffdn\ufffd\ufffdQ\\u0013\ufffd.\ufffd\\\u0022\ufffd\ufffdUE\ufffd\\n\ufffd\ufffd\u072d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 R\ufffd\ufffd\\u001fW\ufffd\u0026\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003ure#\u0022, \u0022path\u0022: \u00220t\\\\:cA}5[\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003URE# 0t\\\\:cA}5[ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003ure# 0t\ufffd\\\\:\ufffdcA}5\ufffd[\\n\\u0018;\ufffd\ufffd{[\\u0012\ufffdE\ufffd\ufffd\ufffd\ufffd] HWx\ufffd\\ff\ufffd;\ufffd8\ufffd\ufffdn\ufffd\ufffdQ\\u0013\ufffd.\ufffd\\\u0022\ufffd\ufffdUE\ufffd\\n\ufffd\ufffd\u072d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 R\ufffd\ufffd\\u001fW\ufffd\u0026\ufffd\\u0004\ufffd\u003E?v\ufffdA\ufffd\\n\\u000eS\ufffd\ufffd\ufffd|l|\ufffd8\ufffd\ufffd\\u000f\ufffd=\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003ure# 0t\ufffd\\\\:\ufffdcA}5\ufffd[\\n\\u0018;\ufffd\ufffd{[\\u0012\ufffdE\ufffd\ufffd\ufffd\ufffd] HWx\ufffd\\ff\ufffd;\ufffd8\ufffd\ufffdn\ufffd\ufffdQ\\u0013\ufffd.\ufffd\\\u0022\ufffd\ufffdUE\ufffd\\n\ufffd\ufffd\u072d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 R\ufffd\ufffd\\u001fW\ufffd\u0026\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002228a3a10fe39ab8923344766c0aa2b679dcd6d513\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003ure#\u0022, \u0022http_path\u0022: \u00220t\\\\:cA}5[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003URE# 0t\\\\:cA}5[ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00227e29fe4d8b0d0da519f4a53161c44c85\u0022, \u0022tls_ja4\u0022: \u002213793626f6e8ff10d9c97730ca3759ea\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdure# 0t\ufffd\\\\:\ufffdcA}5\ufffd[\\n;\ufffd\ufffd{[\ufffdE\ufffd\ufffd\ufffd\ufffd] HWx\ufffdf\ufffd;\ufffd8\ufffd\ufffdn\ufffd\ufffdQ\ufffd.\ufffd\\\u0022\ufffd\ufffdUE\ufffd\\n\ufffd\ufffd\u072d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+3\u0026$ R\ufffd\ufffdW\ufffd\u0026\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 0t\\\\:cA}5[\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-930100-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-930100-sub\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003ure#\u0022, \u0022http_path\u0022: \u00220t\\\\:cA}5[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003URE# 0t\\\\:cA}5[ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00227e29fe4d8b0d0da519f4a53161c44c85\u0022, \u0022tls_ja4\u0022: \u002213793626f6e8ff10d9c97730ca3759ea\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 0t\\\\:cA}5[\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdure# 0t\ufffd\\\\:\ufffdcA}5\ufffd[\\n;\ufffd\ufffd{[\ufffdE\ufffd\ufffd\ufffd\ufffd] HWx\ufffdf\ufffd;\ufffd8\ufffd\ufffdn\ufffd\ufffdQ\ufffd.\ufffd\\\u0022\ufffd\ufffdUE\ufffd\\n\ufffd\ufffd\u072d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+3\u0026$ R\ufffd\ufffdW\ufffd\u0026\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0018;{[\u0012E]","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":241},{"id":419467,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45628,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003tX|JX\u0010","http_target":"n\u0000","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00224c9ecedf5b1fb9420a92a5b02a141fadfdf52ed6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003tX|JX\\u0010\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.849223769914546, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022af718117a44279ce2612c76165b3536af1bc0d5f\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220447adcd74ec1e0dc810745691cb7f97\u0022, \u0022path_pattern_hash\u0022: \u0022481daf8515fdae90077119892b048315\u0022, \u0022ja3\u0022: \u0022136573818e9c79ddd81e7ee45361e36a\u0022, \u0022ja4\u0022: \u002265115dac4308c141e7f2dac4fb9f6e54\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022136573818e9c79ddd81e7ee45361e36a\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-23-45-51-5-43-13-10-11-35,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002265115dac4308c141e7f2dac4fb9f6e54\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_8f547354b2cb_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003tX|JX\\u0010\u0022, \u0022path\u0022: \u0022n\\u0000\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003TX|JX\\u0010 n\\u0000 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003t\ufffdX|JX\\u0010\\u000bn\\u0000\\u001co\ufffd\\u0015\ufffd\ufffd\\u0016\\u001bpV\ufffd\\r43NT\ufffdE\\u0018\u073a\ufffd Fw?\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd={\\u0012i\ufffd\ufffd\ufffdM\ufffd\ufffd\\u0002\u03f8\ufffd\ufffdO3ui\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003tX|JX\\u0010\u0022, \u0022path\u0022: \u0022n\\u0000\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003TX|JX\\u0010 n\\u0000 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003t\ufffdX|JX\\u0010\\u000bn\\u0000\\u001co\ufffd\\u0015\ufffd\ufffd\\u0016\\u001bpV\ufffd\\r43NT\ufffdE\\u0018\u073a\ufffd Fw?\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd={\\u0012i\ufffd\ufffd\ufffdM\ufffd\ufffd\\u0002\u03f8\ufffd\ufffdO3ui\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd_\\u0014\ufffd8\\u001d\ufffd+\ufffd\ufffdtP\\n\ufffd\u02ea\ufffdo1\ufffd\ufffd\ufffd\ufffd2}\ufffd\u003ER\ufffd\\u0018\\u001b\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003t\ufffdX|JX\\u0010\\u000bn\\u0000\\u001co\ufffd\\u0015\ufffd\ufffd\\u0016\\u001bpV\ufffd\\r43NT\ufffdE\\u0018\u073a\ufffd Fw?\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd={\\u0012i\ufffd\ufffd\ufffdM\ufffd\ufffd\\u0002\u03f8\ufffd\ufffdO3ui\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226003b023b60997a93cb7cc827408d61b10c4a8ab\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003tX|JX\\u0010\u0022, \u0022http_path\u0022: \u0022n\\u0000\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003TX|JX\\u0010 n\\u0000 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022136573818e9c79ddd81e7ee45361e36a\u0022, \u0022tls_ja4\u0022: \u002265115dac4308c141e7f2dac4fb9f6e54\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdt\ufffdX|JXno\ufffd\ufffd\ufffdpV\ufffd\\r43NT\ufffdE\u073a\ufffd Fw?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd={i\ufffd\ufffd\ufffdM\ufffd\ufffd\u03f8\ufffd\ufffdO3ui\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 n\\u0000\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003tX|JX\\u0010\u0022, \u0022http_path\u0022: \u0022n\\u0000\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003TX|JX\\u0010 n\\u0000 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022136573818e9c79ddd81e7ee45361e36a\u0022, \u0022tls_ja4\u0022: \u002265115dac4308c141e7f2dac4fb9f6e54\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 n\\u0000\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdt\ufffdX|JXno\ufffd\ufffd\ufffdpV\ufffd\\r43NT\ufffdE\u073a\ufffd Fw?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd={i\ufffd\ufffd\ufffdM\ufffd\ufffd\u03f8\ufffd\ufffdO3ui\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"o\u0015\u0016\u001bpV","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419466,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45544,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"gSl\u0735J[","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00220aea612357a8397cde08411478382b89789bf035\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.919983719154754, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u00221ba25f2ef9bef8aa3e648e7054a7c376ad5f3761\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228340a0abbf2b660247a4e2bd389ebf76\u0022, \u0022path_pattern_hash\u0022: \u0022482ed1c143800e65b4e40a3c725e9a12\u0022, \u0022ja3\u0022: \u00228efc343c35e56d196e279acf88ed35cc\u0022, \u0022ja4\u0022: \u00226afe865a704b40c1ff193096bf353726\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00228efc343c35e56d196e279acf88ed35cc\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-13-23-43-35-11-51-5-16-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00226afe865a704b40c1ff193096bf353726\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_0a6ff5a50417_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022gSl\u0735J[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 gSl\u0735J[ HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001f\ufffdgS\ufffdl\u0735J[\\u001fx (x\\n?\ufffd8N\ufffdx7o\ufffd?\ufffd\ufffdc\ufffd\ufffd \ufffd\\t\ufffd\\u0011\u003E\\u000fu\\b\\u0016\ufffd=@\ufffd\ufffd\\r}(\ufffd\ufffdvd\ufffd\ufffd!=r\\u0013a_\ufffd\ufffdV\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022gSl\u0735J[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 gSl\u0735J[ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001f\ufffdgS\ufffdl\u0735J[\\u001fx (x\\n?\ufffd8N\ufffdx7o\ufffd?\ufffd\ufffdc\ufffd\ufffd \ufffd\\t\ufffd\\u0011\u003E\\u000fu\\b\\u0016\ufffd=@\ufffd\ufffd\\r}(\ufffd\ufffdvd\ufffd\ufffd!=r\\u0013a_\ufffd\ufffdV\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 O\ufffd\\u000f\ufffd\u0159\ufffd\ufffd\ufffd\ufffd87\ufffd\ufffdC\\u0010\ufffd\ufffdw4\ufffd\\u000f\ufffdV\ufffd\ufffd])\ufffd\ufffd\\u0015!\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u001f\ufffdgS\ufffdl\u0735J[\\u001fx (x\\n?\ufffd8N\ufffdx7o\ufffd?\ufffd\ufffdc\ufffd\ufffd \ufffd\\t\ufffd\\u0011\u003E\\u000fu\\b\\u0016\ufffd=@\ufffd\ufffd\\r}(\ufffd\ufffdvd\ufffd\ufffd!=r\\u0013a_\ufffd\ufffdV\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228f6ba92f6683a1eebdc8a45df75741a79916b2bc\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022gSl\u0735J[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 gSl\u0735J[ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00228efc343c35e56d196e279acf88ed35cc\u0022, \u0022tls_ja4\u0022: \u00226afe865a704b40c1ff193096bf353726\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdgS\ufffdl\u0735J[x (x\\n?\ufffd8N\ufffdx7o\ufffd?\ufffd\ufffdc\ufffd\ufffd \ufffd\\t\ufffd\u003Eu\ufffd=@\ufffd\ufffd\\r}(\ufffd\ufffdvd\ufffd\ufffd!=ra_\ufffd\ufffdV\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 gSl\u0735J[\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022gSl\u0735J[\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 gSl\u0735J[ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00228efc343c35e56d196e279acf88ed35cc\u0022, \u0022tls_ja4\u0022: \u00226afe865a704b40c1ff193096bf353726\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 gSl\u0735J[\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdgS\ufffdl\u0735J[x (x\\n?\ufffd8N\ufffdx7o\ufffd?\ufffd\ufffdc\ufffd\ufffd \ufffd\\t\ufffd\u003Eu\ufffd=@\ufffd\ufffd\\r}(\ufffd\ufffdvd\ufffd\ufffd!=ra_\ufffd\ufffdV\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"x","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419465,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45562,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\u0003\u0011\u0010","http_target":"+\u003C:\u0026w.q:Arr%v,\u01e0\u003C\u0018\u0016","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022q:arr%v,\u01e1\u003C\\u0018\\u0016\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002265a442b5742c50c87fc2c7e7f2c03f7fa38105e6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.875059085477464, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u0022acf6c0cd1894755c3ed9d5ec025b0ed75915a319\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0768\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b2ff4d0fe99345137a0aa5fea016661b\u0022, \u0022path_pattern_hash\u0022: \u0022c7ce6124cc8a6cfc65928a0e70d2da85\u0022, \u0022ja3\u0022: \u0022ee74bdfb88880fca6e4e27344e8ca54d\u0022, \u0022ja4\u0022: \u0022347defe7944d04eb4cd6bbd223e87a26\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022ee74bdfb88880fca6e4e27344e8ca54d\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-51-10-11-45-43-16-13-23-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022347defe7944d04eb4cd6bbd223e87a26\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_a1f434d06af0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010\u0022, \u0022path\u0022: \u0022+\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0003\\u0011\ufffd\\u0010\ufffd\\u001f+\u003C:\u0026w\ufffd\ufffd.q:\ufffdArr%v,\ufffd\u01e0\ufffd\u003C\ufffd\\u0018\\u0016 \ufffd\ufffd\ufffdhb\ufffd\\u0015\ufffd\u0026\ufffd\ufffdd\ufffd\ufffd^\u017a\ufffd\ufffdK\ufffd4\ufffdo\\u001e\ufffdP\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 :\ufffdp\ufffd_H4t\ufffd\ufffdE\\u0007\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010\u0022, \u0022path\u0022: \u0022+\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0003\\u0011\ufffd\\u0010\ufffd\\u001f+\u003C:\u0026w\ufffd\ufffd.q:\ufffdArr%v,\ufffd\u01e0\ufffd\u003C\ufffd\\u0018\\u0016 \ufffd\ufffd\ufffdhb\ufffd\\u0015\ufffd\u0026\ufffd\ufffdd\ufffd\ufffd^\u017a\ufffd\ufffdK\ufffd4\ufffdo\\u001e\ufffdP\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 :\ufffdp\ufffd_H4t\ufffd\ufffdE\\u0007\ufffd\\u001cK\ufffd\\u0007\ufffd=d\u0026\ufffd\ufffdl*\ufffdPu+)f\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0003\\u0011\ufffd\\u0010\ufffd\\u001f+\u003C:\u0026w\ufffd\ufffd.q:\ufffdArr%v,\ufffd\u01e0\ufffd\u003C\ufffd\\u0018\\u0016 \ufffd\ufffd\ufffdhb\ufffd\\u0015\ufffd\u0026\ufffd\ufffdd\ufffd\ufffd^\u017a\ufffd\ufffdK\ufffd4\ufffdo\\u001e\ufffdP\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 :\ufffdp\ufffd_H4t\ufffd\ufffdE\\u0007\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002292fb332d8c39650b83492f3a35f2711a310b5183\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010\u0022, \u0022http_path\u0022: \u0022+\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022ee74bdfb88880fca6e4e27344e8ca54d\u0022, \u0022tls_ja4\u0022: \u0022347defe7944d04eb4cd6bbd223e87a26\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd+\u003C:\u0026w\ufffd\ufffd.q:\ufffdArr%v,\ufffd\u01e0\ufffd\u003C\ufffd \ufffd\ufffd\ufffdhb\ufffd\ufffd\u0026\ufffd\ufffdd\ufffd\ufffd^\u017a\ufffd\ufffdK\ufffd4\ufffdo\ufffdP\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#3\u0026$ :\ufffdp\ufffd_H4t\ufffd\ufffdE\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0768\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0768\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010\u0022, \u0022http_path\u0022: \u0022+\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\u0003\\u0011\\u0010 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022ee74bdfb88880fca6e4e27344e8ca54d\u0022, \u0022tls_ja4\u0022: \u0022347defe7944d04eb4cd6bbd223e87a26\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 +\u003C:\u0026w.q:Arr%v,\u01e0\u003C\\u0018\\u0016\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd+\u003C:\u0026w\ufffd\ufffd.q:\ufffdArr%v,\ufffd\u01e0\ufffd\u003C\ufffd \ufffd\ufffd\ufffdhb\ufffd\ufffd\u0026\ufffd\ufffdd\ufffd\ufffd^\u017a\ufffd\ufffdK\ufffd4\ufffdo\ufffdP\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#3\u0026$ :\ufffdp\ufffd_H4t\ufffd\ufffdE\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"hb\u0015\u0026d^\u017aK4o","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419464,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45512,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003","http_target":"AB,1\u0004","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022c7f2a07cf2a7aef33f43f50216432b8a38e02f07\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.842499314958511, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022b46e4c17b22760b18953c52551865e115becde7c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022179efce24fdeac38d7bdf34b765ca931\u0022, \u0022path_pattern_hash\u0022: \u0022fa1251501fa8d8f1811e705073349f44\u0022, \u0022ja3\u0022: \u00223282214646932a1adf2c86459875719c\u0022, \u0022ja4\u0022: \u002282c58ee94467a4f277f1f873b320f6b1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00223282214646932a1adf2c86459875719c\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-5-10-35-11-16-13-43-23-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002282c58ee94467a4f277f1f873b320f6b1\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_3d9232d08826_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022AB,1\\u0004\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 AB,1\\u0004 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\\u001f\ufffdAB\ufffd,\ufffd1\ufffd\ufffd\\u0004\ufffd\ufffd\\rp\ufffd\ufffdD\\u0012\uf223%!Wi\ufffdd \ufffd\\u0019\ufffd\\u001a\ufffd\ufffdFB*\\u0011\ufffd\ufffdE\\u001b\ufffdA\ufffd\ufffd\\u001a\ufffd\ufffdp\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdD\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022path\u0022: \u0022AB,1\\u0004\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 AB,1\\u0004 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\\u001f\ufffdAB\ufffd,\ufffd1\ufffd\ufffd\\u0004\ufffd\ufffd\\rp\ufffd\ufffdD\\u0012\uf223%!Wi\ufffdd \ufffd\\u0019\ufffd\\u001a\ufffd\ufffdFB*\\u0011\ufffd\ufffdE\\u001b\ufffdA\ufffd\ufffd\\u001a\ufffd\ufffdp\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdD\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\\u0003\\u0018\ufffd\ufffd~\u0026\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\\u0001\ufffd`\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd[\\u0003S\\u001e\\u000b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\\u001f\ufffdAB\ufffd,\ufffd1\ufffd\ufffd\\u0004\ufffd\ufffd\\rp\ufffd\ufffdD\\u0012\uf223%!Wi\ufffdd \ufffd\\u0019\ufffd\\u001a\ufffd\ufffdFB*\\u0011\ufffd\ufffdE\\u001b\ufffdA\ufffd\ufffd\\u001a\ufffd\ufffdp\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdD\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bca96d4db88b89cabcff1af5fe8576aae82941ca\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022AB,1\\u0004\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 AB,1\\u0004 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00223282214646932a1adf2c86459875719c\u0022, \u0022tls_ja4\u0022: \u002282c58ee94467a4f277f1f873b320f6b1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdAB\ufffd,\ufffd1\ufffd\ufffd\ufffd\ufffd\\rp\ufffd\ufffdD\uf223%!Wi\ufffdd \ufffd\ufffd\ufffd\ufffdFB*\ufffd\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 AB,1\\u0004\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0022, \u0022http_path\u0022: \u0022AB,1\\u0004\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003 AB,1\\u0004 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00223282214646932a1adf2c86459875719c\u0022, \u0022tls_ja4\u0022: \u002282c58ee94467a4f277f1f873b320f6b1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 AB,1\\u0004\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdAB\ufffd,\ufffd1\ufffd\ufffd\ufffd\ufffd\\rp\ufffd\ufffdD\uf223%!Wi\ufffdd \ufffd\ufffd\ufffd\ufffdFB*\ufffd\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"pD\u0012\uf223%!Wid","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419463,"ip":"140.245.126.95","ts":"2026-10-12 12:48:43.000000","proto":"tcp","src_port":45550,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\b\u000eWo","http_target":"V4~","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002262fa973fd7a82d5da79ac69233ef7ce7b84ddc05\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWo\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.847296826152263, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022a02134a5b2c12285925ca0857914afaf375bbfae\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229bebe3759ca95274d8533749e83d2d7f\u0022, \u0022path_pattern_hash\u0022: \u002242357207b51070956ec6e49a7f55b6cc\u0022, \u0022ja3\u0022: \u00227e0828ac78f32293a2ead357456823dc\u0022, \u0022ja4\u0022: \u0022b16c851eed2ac7fc3e2565c1c0c62d61\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00227e0828ac78f32293a2ead357456823dc\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-35-11-51-16-5-45-23-13-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022b16c851eed2ac7fc3e2565c1c0c62d61\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_fdee05899c5e_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWo\u0022, \u0022path\u0022: \u0022V4~\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWO V4~ HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\b\ufffd\\u000eWo \ufffdV\ufffd4\ufffd\ufffd~\ufffd\\n\ufffd^\ufffd\u079e\\u0007\\u0002\ufffd\\u0000-\\u0013\\u001a\ufffd Y\ufffd\ufffd2S\ufffd\ufffdg\ufffd\ufffdl\ufffd\ufffdY+\ufffdCC%\ufffd\ufffd\ufffd.\\u0019Nf~\ufffd6\ufffd\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWo\u0022, \u0022path\u0022: \u0022V4~\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWO V4~ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\b\ufffd\\u000eWo \ufffdV\ufffd4\ufffd\ufffd~\ufffd\\n\ufffd^\ufffd\u079e\\u0007\\u0002\ufffd\\u0000-\\u0013\\u001a\ufffd Y\ufffd\ufffd2S\ufffd\ufffdg\ufffd\ufffdl\ufffd\ufffdY+\ufffdCC%\ufffd\ufffd\ufffd.\\u0019Nf~\ufffd6\ufffd\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdI\ufffd\ufffd\ufffd\u0dad[\ufffd}\\b\ufffd\ufffd\\u0005\ufffd\ufffd\\u000eTP\\u0004\u0026\ufffd\ufffd.\ufffdip\ufffd\ufffd\u0027\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\\b\ufffd\\u000eWo \ufffdV\ufffd4\ufffd\ufffd~\ufffd\\n\ufffd^\ufffd\u079e\\u0007\\u0002\ufffd\\u0000-\\u0013\\u001a\ufffd Y\ufffd\ufffd2S\ufffd\ufffdg\ufffd\ufffdl\ufffd\ufffdY+\ufffdCC%\ufffd\ufffd\ufffd.\\u0019Nf~\ufffd6\ufffd\ufffd)\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fefdc065985fd5718e06dd59a9ff9340ae3d04a4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWo\u0022, \u0022http_path\u0022: \u0022V4~\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWO V4~ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00227e0828ac78f32293a2ead357456823dc\u0022, \u0022tls_ja4\u0022: \u0022b16c851eed2ac7fc3e2565c1c0c62d61\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdWo \ufffdV\ufffd4\ufffd\ufffd~\ufffd\\n\ufffd^\ufffd\u079e\ufffd-\ufffd Y\ufffd\ufffd2S\ufffd\ufffdg\ufffd\ufffdl\ufffd\ufffdY+\ufffdCC%\ufffd\ufffd\ufffd.Nf~\ufffd6\ufffd\ufffd)\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#3\u0026$\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 V4~\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWo\u0022, \u0022http_path\u0022: \u0022V4~\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\\b\\u000eWO V4~ HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00227e0828ac78f32293a2ead357456823dc\u0022, \u0022tls_ja4\u0022: \u0022b16c851eed2ac7fc3e2565c1c0c62d61\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 V4~\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdWo \ufffdV\ufffd4\ufffd\ufffd~\ufffd\\n\ufffd^\ufffd\u079e\ufffd-\ufffd Y\ufffd\ufffd2S\ufffd\ufffdg\ufffd\ufffdl\ufffd\ufffdY+\ufffdCC%\ufffd\ufffd\ufffd.Nf~\ufffd6\ufffd\ufffd)\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#3\u0026$\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"^\u079e\u0007\u0002\u0000-\u0013\u001a","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419421,"ip":"140.245.126.95","ts":"2026-10-12 12:48:42.000000","proto":"tcp","src_port":45440,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":14,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950325:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003\u0027\/","http_target":"\u0011\u0012\u0014R\u0011F|2sWQ?h+`","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 1, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022c55f97716efd75d2c854a518a06ebf7085e96aa9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.881916798108086, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226cf896d7cc63f5e5958c51d68d293363c7682911\u0022, \u0022event_fingerprint\u0022: \u0022ac28e2ff4a2ebdf0a6ca7d6eca7de84c1efb5896\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 55, \u0022precision_signals\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222cf84d4f018ec811010d17309776dc7f\u0022, \u0022path_pattern_hash\u0022: \u0022aafb380faaabc17c32ec4528ea10838c\u0022, \u0022ja3\u0022: \u00220178f8bc18e61fb16e89808f07fb8ad2\u0022, \u0022ja4\u0022: \u00229f0ab644320e5311d91ea8175a5d2ee1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00220178f8bc18e61fb16e89808f07fb8ad2\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-10-23-43-45-51-11-13-5-35,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00229f0ab644320e5311d91ea8175a5d2ee1\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_abc6654ec9fd_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/\u0022, \u0022path\u0022: \u0022\\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022query_string\u0022: \u0022h+`\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950325:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/ \\u0011\\u0012\\u0014R\\u0011F|2sWQ?h+` HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0027\/\\f\ufffd\ufffd\\u0011\ufffd\ufffd\\u0012\ufffd\\u0014R\ufffd\ufffd\\u0011F\ufffd\ufffd|2s\ufffdWQ\ufffd?h+`\ufffd\ufffd \u0026\\u0006L\ufffd\ufffd\ufffdP\ufffd\\\\\ufffdb\\n\ufffdJ\ufffd\ufffd\ufffd\\tk_N\ufffd\ufffd\ufffd\\u0011v\ufffd\\u0018\\u0005-E\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/\u0022, \u0022path\u0022: \u0022\\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022query_string\u0022: \u0022h+`\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950325:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/ \\u0011\\u0012\\u0014R\\u0011F|2sWQ?h+` HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0027\/\\f\ufffd\ufffd\\u0011\ufffd\ufffd\\u0012\ufffd\\u0014R\ufffd\ufffd\\u0011F\ufffd\ufffd|2s\ufffdWQ\ufffd?h+`\ufffd\ufffd \u0026\\u0006L\ufffd\ufffd\ufffdP\ufffd\\\\\ufffdb\\n\ufffdJ\ufffd\ufffd\ufffd\\tk_N\ufffd\ufffd\ufffd\\u0011v\ufffd\\u0018\\u0005-E\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\\u0003\\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\u0339\ufffd\ufffd\ufffd\\n\ufffd\\u001c\u017d\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000#\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0027\/\\f\ufffd\ufffd\\u0011\ufffd\ufffd\\u0012\ufffd\\u0014R\ufffd\ufffd\\u0011F\ufffd\ufffd|2s\ufffdWQ\ufffd?h+`\ufffd\ufffd \u0026\\u0006L\ufffd\ufffd\ufffdP\ufffd\\\\\ufffdb\\n\ufffdJ\ufffd\ufffd\ufffd\\tk_N\ufffd\ufffd\ufffd\\u0011v\ufffd\\u0018\\u0005-E\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022db7fa9c9a4607536197e3c1374ab0125714cb7cd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/\u0022, \u0022http_path\u0022: \u0022\\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/ \\u0011\\u0012\\u0014R\\u0011F|2sWQ?h+` HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00220178f8bc18e61fb16e89808f07fb8ad2\u0022, \u0022tls_ja4\u0022: \u00229f0ab644320e5311d91ea8175a5d2ee1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0027\/\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdF\ufffd\ufffd|2s\ufffdWQ\ufffd?h+`\ufffd\ufffd \u0026L\ufffd\ufffd\ufffdP\ufffd\\\\\ufffdb\\n\ufffdJ\ufffd\ufffd\ufffd\\tk_N\ufffd\ufffd\ufffdv\ufffd-E\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/\u0022, \u0022http_path\u0022: \u0022\\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003\u0027\/ \\u0011\\u0012\\u0014R\\u0011F|2sWQ?h+` HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00220178f8bc18e61fb16e89808f07fb8ad2\u0022, \u0022tls_ja4\u0022: \u00229f0ab644320e5311d91ea8175a5d2ee1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \\u0011\\u0012\\u0014R\\u0011F|2sWQ\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0027\/\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdF\ufffd\ufffd|2s\ufffdWQ\ufffd?h+`\ufffd\ufffd \u0026L\ufffd\ufffd\ufffdP\ufffd\\\\\ufffdb\\n\ufffdJ\ufffd\ufffd\ufffd\\tk_N\ufffd\ufffd\ufffdv\ufffd-E\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950325:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0026\u0006LP\\b","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950325:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419410,"ip":"140.245.126.95","ts":"2026-10-12 12:48:42.000000","proto":"tcp","src_port":45396,"dst_port":8888,"service":"http","classification":"postgres_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003o`%\u0011\u0354\u0700}","http_target":"G","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022a36a6718f54524d846894fb04b5b885b4e43e63b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003o`%\\u0011\u0354\u0700}\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.965186428655091, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022787864fe23ce571ba30872b605f284e1b0a15916\u0022, \u0022event_fingerprint\u0022: \u0022313d5462a9a8a8ef0a798cbb03e8548833c010ae\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226fbc43c071ae3cb4674e0034088a07b9\u0022, \u0022path_pattern_hash\u0022: \u0022cd0aa9856147b6c5b4ff2b7dfee5da20\u0022, \u0022ja3\u0022: \u00226fe391dfd91d68ce14fcc93f6d5192cf\u0022, \u0022ja4\u0022: \u002250ef33668e914696e6951a27796bab0a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00226fe391dfd91d68ce14fcc93f6d5192cf\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-13-23-5-51-16-35-10-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002250ef33668e914696e6951a27796bab0a\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_e3484ebcd27c_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003o`%\\u0011\u0354\u0700}\u0022, \u0022path\u0022: \u0022G\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003O`%\\u0011\u0354\u0700} G HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003o`\ufffd\ufffd%\\u0011\ufffd\u0354\ufffd\ufffd\ufffd\u0700}\ufffd\ufffd\ufffd\ufffd\\tG\\nG#\ufffds\\rm\\u0004\\\u0022\ufffd \ufffd\ufffd\\u001bCp\ufffdD\\u001b9\u003E\ufffd\ufffd8\\u0006R\ufffdy\\\\\ufffd##n\\\u0022\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003o`%\\u0011\u0354\u0700}\u0022, \u0022path\u0022: \u0022G\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003O`%\\u0011\u0354\u0700} G HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003o`\ufffd\ufffd%\\u0011\ufffd\u0354\ufffd\ufffd\ufffd\u0700}\ufffd\ufffd\ufffd\ufffd\\tG\\nG#\ufffds\\rm\\u0004\\\u0022\ufffd \ufffd\ufffd\\u001bCp\ufffdD\\u001b9\u003E\ufffd\ufffd8\\u0006R\ufffdy\\\\\ufffd##n\\\u0022\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 fM\ufffdTz\\u0014\ufffd~\ufffd\ufffdU\ufffd\\u0012\ufffd\ufffddx\ufffd\u02e4@q\ufffd\u003C_\ufffd\\\\\ufffdBmE\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003o`\ufffd\ufffd%\\u0011\ufffd\u0354\ufffd\ufffd\ufffd\u0700}\ufffd\ufffd\ufffd\ufffd\\tG\\nG#\ufffds\\rm\\u0004\\\u0022\ufffd \ufffd\ufffd\\u001bCp\ufffdD\\u001b9\u003E\ufffd\ufffd8\\u0006R\ufffdy\\\\\ufffd##n\\\u0022\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e25acf39198be9589bb8aece197592c3a06e65ba\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003o`%\\u0011\u0354\u0700}\u0022, \u0022http_path\u0022: \u0022G\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003O`%\\u0011\u0354\u0700} G HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00226fe391dfd91d68ce14fcc93f6d5192cf\u0022, \u0022tls_ja4\u0022: \u002250ef33668e914696e6951a27796bab0a\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdo`\ufffd\ufffd%\ufffd\u0354\ufffd\ufffd\ufffd\u0700}\ufffd\ufffd\ufffd\ufffd\\tG\\nG#\ufffds\\rm\\\u0022\ufffd \ufffd\ufffdCp\ufffdD9\u003E\ufffd\ufffd8R\ufffdy\\\\\ufffd##n\\\u0022\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 G\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003o`%\\u0011\u0354\u0700}\u0022, \u0022http_path\u0022: \u0022G\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003O`%\\u0011\u0354\u0700} G HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00226fe391dfd91d68ce14fcc93f6d5192cf\u0022, \u0022tls_ja4\u0022: \u002250ef33668e914696e6951a27796bab0a\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 G\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdo`\ufffd\ufffd%\ufffd\u0354\ufffd\ufffd\ufffd\u0700}\ufffd\ufffd\ufffd\ufffd\\tG\\nG#\ufffds\\rm\\\u0022\ufffd \ufffd\ufffdCp\ufffdD9\u003E\ufffd\ufffd8R\ufffdy\\\\\ufffd##n\\\u0022\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"G#s","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":241},{"id":419409,"ip":"140.245.126.95","ts":"2026-10-12 12:48:42.000000","proto":"tcp","src_port":45412,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003bd","http_target":"A$d]\u0017P]\u0001q8j\u0003s\u04a1\u0015","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00225fad93477dd92072f188dc23d1586bf6fdeac18c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003bd\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.850996659045089, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u00225e4e591b4187009473412a9ba9126b3d9c35c40d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ca54c5fb5f6ecf876e9bdeb7858550e9\u0022, \u0022path_pattern_hash\u0022: \u00223a761dcfed599e32ea355db0d99a260e\u0022, \u0022ja3\u0022: \u00222f6e29c155f2163a5732b0598a6ae6c4\u0022, \u0022ja4\u0022: \u0022af98a14cb2fa8e45ccb49051f9ab7381\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00222f6e29c155f2163a5732b0598a6ae6c4\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-11-35-23-16-51-43-5-45-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022af98a14cb2fa8e45ccb49051f9ab7381\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_84da8f0aa721_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003bd\u0022, \u0022path\u0022: \u0022A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003BD A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015 HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003bd\\f\ufffd\ufffdA\ufffd$\ufffdd]\\u0017P\ufffd\ufffd]\ufffd\\u0001\ufffdq\ufffd8j\\u0003\ufffd\ufffds\u04a1\ufffd\\u0015\ufffd \ufffd\\u0007\ufffd\ufffd\ufffd\\u0013^\ufffd\ufffd\\u0001*\\u0002\ufffd.T\ufffd\u06c6\\u000bg\ufffd\ufffd\ufffd\ufffd\\b%I\ufffd\\u0003\ufffdR\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003bd\u0022, \u0022path\u0022: \u0022A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003BD A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003bd\\f\ufffd\ufffdA\ufffd$\ufffdd]\\u0017P\ufffd\ufffd]\ufffd\\u0001\ufffdq\ufffd8j\\u0003\ufffd\ufffds\u04a1\ufffd\\u0015\ufffd \ufffd\\u0007\ufffd\ufffd\ufffd\\u0013^\ufffd\ufffd\\u0001*\\u0002\ufffd.T\ufffd\u06c6\\u000bg\ufffd\ufffd\ufffd\ufffd\\b%I\ufffd\\u0003\ufffdR\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 f\ufffd\ufffd\\u000b\ufffd!+j\ufffd\ufffd\\u000f\ufffd`\ufffd\ufffd\\u001d\ufffd\ufffd\\u001e~\\u000eB|\ufffd\ufffd\\u0017\ufffd\ufffds\ufffd\ufffdn\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003bd\\f\ufffd\ufffdA\ufffd$\ufffdd]\\u0017P\ufffd\ufffd]\ufffd\\u0001\ufffdq\ufffd8j\\u0003\ufffd\ufffds\u04a1\ufffd\\u0015\ufffd \ufffd\\u0007\ufffd\ufffd\ufffd\\u0013^\ufffd\ufffd\\u0001*\\u0002\ufffd.T\ufffd\u06c6\\u000bg\ufffd\ufffd\ufffd\ufffd\\b%I\ufffd\\u0003\ufffdR\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002260092365c6e11ac150cd1ae47d1b8d9e7b68f704\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003bd\u0022, \u0022http_path\u0022: \u0022A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003BD A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222f6e29c155f2163a5732b0598a6ae6c4\u0022, \u0022tls_ja4\u0022: \u0022af98a14cb2fa8e45ccb49051f9ab7381\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdbd\ufffd\ufffdA\ufffd$\ufffdd]P\ufffd\ufffd]\ufffd\ufffdq\ufffd8j\ufffd\ufffds\u04a1\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd*\ufffd.T\ufffd\u06c6g\ufffd\ufffd\ufffd\ufffd%I\ufffd\ufffdR\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003bd\u0022, \u0022http_path\u0022: \u0022A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003BD A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015 HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u00222f6e29c155f2163a5732b0598a6ae6c4\u0022, \u0022tls_ja4\u0022: \u0022af98a14cb2fa8e45ccb49051f9ab7381\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 A$d]\\u0017P]\\u0001q8j\\u0003s\u04a1\\u0015\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdbd\ufffd\ufffdA\ufffd$\ufffdd]P\ufffd\ufffd]\ufffd\ufffdq\ufffd8j\ufffd\ufffds\u04a1\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd*\ufffd.T\ufffd\u06c6g\ufffd\ufffd\ufffd\ufffd%I\ufffd\ufffdR\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0007\u0013^\u0001*\u0002.T\u06c6","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419142,"ip":"140.245.126.95","ts":"2026-10-12 12:48:26.000000","proto":"tcp","src_port":59402,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003T\u000f","http_target":"\u001b\u001b\u001b%2}A$\u0006\u0005Xh","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00221a832146a5e094bfd7f613980d3987220775c60a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.86144582836893, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u0022acb64395ff7f23a23ee9e57eab399db9e6a10987\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002257ea2a4e840502a60fa52a9ad07d7cc0\u0022, \u0022path_pattern_hash\u0022: \u002255bdab418158eb4c299d2867d1d505a5\u0022, \u0022ja3\u0022: \u0022c1eb23737701757a9cc326185b613196\u0022, \u0022ja4\u0022: \u002202855a9d72107894bc13c0a9fc637ed0\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c1eb23737701757a9cc326185b613196\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-45-35-5-11-23-43-13-16-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002202855a9d72107894bc13c0a9fc637ed0\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_8b65dbe2c618_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f\u0022, \u0022path\u0022: \u0022\\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdT\ufffd\ufffd\\u000f\ufffd\\f\\u001b\\u001b\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffd%2}A$\ufffd\\u0006\ufffd\\u0005\ufffdXh C\\th\ufffdV]\ufffdY!\\u001e[\ufffdU\ufffd\ufffd\ufffd\ufffd\\u001dEJ\ufffd\ufffdM\ufffd\ufffdc.\ufffd\\u000fy\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffdp\ufffd\ufffd\\u001d\ufffd\\u001b!\ufffdS\ufffd3Q\ufffd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f\u0022, \u0022path\u0022: \u0022\\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdT\ufffd\ufffd\\u000f\ufffd\\f\\u001b\\u001b\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffd%2}A$\ufffd\\u0006\ufffd\\u0005\ufffdXh C\\th\ufffdV]\ufffdY!\\u001e[\ufffdU\ufffd\ufffd\ufffd\ufffd\\u001dEJ\ufffd\ufffdM\ufffd\ufffdc.\ufffd\\u000fy\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffdp\ufffd\ufffd\\u001d\ufffd\\u001b!\ufffdS\ufffd3Q\ufffd\\u001f\ufffd\\u0012\ufffd]Aq\\u0012\\n\ufffd\ufffda\\u0000\/\\u001c\ufffd\\u0011\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdT\ufffd\ufffd\\u000f\ufffd\\f\\u001b\\u001b\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffd%2}A$\ufffd\\u0006\ufffd\\u0005\ufffdXh C\\th\ufffdV]\ufffdY!\\u001e[\ufffdU\ufffd\ufffd\ufffd\ufffd\\u001dEJ\ufffd\ufffdM\ufffd\ufffdc.\ufffd\\u000fy\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffdp\ufffd\ufffd\\u001d\ufffd\\u001b!\ufffdS\ufffd3Q\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022db687652d45b5e3750e08722edf98efef95bf3c4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f\u0022, \u0022http_path\u0022: \u0022\\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022c1eb23737701757a9cc326185b613196\u0022, \u0022tls_ja4\u0022: \u002202855a9d72107894bc13c0a9fc637ed0\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%2}A$\ufffd\ufffd\ufffdXh C\\th\ufffdV]\ufffdY![\ufffdU\ufffd\ufffd\ufffd\ufffdEJ\ufffd\ufffdM\ufffd\ufffdc.\ufffdy\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \ufffd\ufffdp\ufffd\ufffd\ufffd!\ufffdS\ufffd3Q\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f\u0022, \u0022http_path\u0022: \u0022\\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003T\\u000f \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022c1eb23737701757a9cc326185b613196\u0022, \u0022tls_ja4\u0022: \u002202855a9d72107894bc13c0a9fc637ed0\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \\u001b\\u001b\\u001b%2}A$\\u0006\\u0005Xh\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%2}A$\ufffd\ufffd\ufffdXh C\\th\ufffdV]\ufffdY![\ufffdU\ufffd\ufffd\ufffd\ufffdEJ\ufffd\ufffdM\ufffd\ufffdc.\ufffdy\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \ufffd\ufffdp\ufffd\ufffd\ufffd!\ufffdS\ufffd3Q\ufffd\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"C","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":419141,"ip":"140.245.126.95","ts":"2026-10-12 12:48:26.000000","proto":"tcp","src_port":59396,"dst_port":8888,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0000\u0001\u0000\u0000\u0003\u0003[\u0000,","http_target":"sH\u05a6,\u0012RVP\u0027$\u000fO\b\u003E","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00229ab74714257c604a9800064baa8b18a50e20ed02\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000,\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.819586827735839, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022SG\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c31540877fd1262b42c3c6383a6ce4651ec19884\u0022, \u0022event_fingerprint\u0022: \u0022d03b5127da5afda075508e05322f8d7eb3ea7617\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022SG\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022af4bc1af52766d8dc5e8931c299d19fa\u0022, \u0022path_pattern_hash\u0022: \u00220fb9b5ab7b5aa6471c9dc38c3df7385f\u0022, \u0022ja3\u0022: \u0022a6ce59840a53afa21d04df12a994e347\u0022, \u0022ja4\u0022: \u002292168a7670a3561ba1a5d1c5fc42ef9d\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022a6ce59840a53afa21d04df12a994e347\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-35-16-10-43-51-45-13-23-11,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002292168a7670a3561ba1a5d1c5fc42ef9d\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_30d1cbb97201_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000,\u0022, \u0022path\u0022: \u0022sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000, sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[\\u0000,\\r\ufffd\ufffd\\u001e\ufffdsH\ufffd\u05a6,\ufffd\\u0012R\ufffdVP\ufffd\u0027\ufffd$\ufffd\\u000fO\\b\ufffd\ufffd\u003E\ufffd \ufffd8=\ufffdK\ufffdG!\ufffd\\u0002q\ufffdt\ufffdX\ufffd\ufffd\ufffd\u03db\ufffdK[\u00a7\ufffd\\fm\ufffd\u01d5\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000,\u0022, \u0022path\u0022: \u0022sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000, sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[\\u0000,\\r\ufffd\ufffd\\u001e\ufffdsH\ufffd\u05a6,\ufffd\\u0012R\ufffdVP\ufffd\u0027\ufffd$\ufffd\\u000fO\\b\ufffd\ufffd\u003E\ufffd \ufffd8=\ufffdK\ufffdG!\ufffd\\u0002q\ufffdt\ufffdX\ufffd\ufffd\ufffd\u03db\ufffdK[\u00a7\ufffd\\fm\ufffd\u01d5\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\u000er\ufffd\ufffd\ufffdXG\ufffd\ufffd\u01a8+\ufffd\ufffd\\u0011t\ufffd8\\nK\\u0004\ufffd\ufffd{U\\u001aT\u00e3\\u0010\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[\\u0000,\\r\ufffd\ufffd\\u001e\ufffdsH\ufffd\u05a6,\ufffd\\u0012R\ufffdVP\ufffd\u0027\ufffd$\ufffd\\u000fO\\b\ufffd\ufffd\u003E\ufffd \ufffd8=\ufffdK\ufffdG!\ufffd\\u0002q\ufffdt\ufffdX\ufffd\ufffd\ufffd\u03db\ufffdK[\u00a7\ufffd\\fm\ufffd\u01d5\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f0802f5dcc6f4a49d29c958c69b2d0a834acd825\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000,\u0022, \u0022http_path\u0022: \u0022sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000, sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022a6ce59840a53afa21d04df12a994e347\u0022, \u0022tls_ja4\u0022: \u002292168a7670a3561ba1a5d1c5fc42ef9d\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd[,\\r\ufffd\ufffd\ufffdsH\ufffd\u05a6,\ufffdR\ufffdVP\ufffd\u0027\ufffd$\ufffdO\ufffd\ufffd\u003E\ufffd \ufffd8=\ufffdK\ufffdG!\ufffdq\ufffdt\ufffdX\ufffd\ufffd\ufffd\u03db\ufffdK[\u00a7\ufffdm\ufffd\u01d5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\\thttp\/1\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000,\u0022, \u0022http_path\u0022: \u0022sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\\u0001\\u0000\\u0000\\u0003\\u0003[\\u0000, sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E HTTP\/1.1\u0022, \u0022tls_ja3\u0022: \u0022a6ce59840a53afa21d04df12a994e347\u0022, \u0022tls_ja4\u0022: \u002292168a7670a3561ba1a5d1c5fc42ef9d\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 sH\u05a6,\\u0012RVP\u0027$\\u000fO\\b\u003E\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd[,\\r\ufffd\ufffd\ufffdsH\ufffd\u05a6,\ufffdR\ufffdVP\ufffd\u0027\ufffd$\ufffdO\ufffd\ufffd\u003E\ufffd \ufffd8=\ufffdK\ufffdG!\ufffdq\ufffdt\ufffdX\ufffd\ufffd\ufffd\u03db\ufffdK[\u00a7\ufffdm\ufffd\u01d5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\\thttp\/1\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"8=KG!\u0002qtX\u03dbK[\u00a7","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":241}],"total_events":85}