143.20.137.85

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 149,
    "payload_entropy": 3.9113009667510985,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c2c963a6e6d6536bddc7263df667a66d",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000#\ufffdVQ\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\/Satoshi:0.14.2(BIP148)",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000#\ufffdVQ\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\/Satoshi:0.14.2(BIP148)\/Knots:20170618\/:\ufffd\u000e\u0000\u0001",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000#\ufffdVQ\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\/Satoshi:0.14.2(BIP148)",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4465053cd83c1b542ad65e15419dd1909df38743",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000#\ufffdVQ\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\/Satoshi:0.14.2(BIP148)",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion}#\ufffdVQ\ufffdC\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd'\/Satoshi:0.14.2(BIP148)",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000#\ufffdVQ\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\/Satoshi:0.14.2(BIP148)",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion}#\ufffdVQ\ufffdC\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd'\/Satoshi:0.14.2(BIP148)",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7c3404bd6d5fba32bcc5a5d202d29cf7",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "711d04d307425bcc3ddd5ac1383d7a7e848bda5d",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdK\r\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdK\r\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdK\r\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec5d8ad258d04af30ddb91dd9072ff01",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "669cee6452a3df1986ce9aaf48347d3e28267cf0",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd:\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd:\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd:\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8326c4c4a4146cd890f08bfb176a6ddf",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "50ce3355740e98243aa77746c32c6b30ffbd4f32",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd8\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd8\ufffd\u0007",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd8\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ca54be98641137d6598220878cd39add",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0fe0b99385a55ca269685ee7f13fbf00b2cc4416",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhg\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000g\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhg\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8b28570a93865b28a750ea2a8a3fb7ac",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c8ca76bc83295750cd37e3801fb6ade0cdfc1434",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf0kz$",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u00000kz$",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf0kz$",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "98fdb54e569b1d2d4b6c6643a3ef4bda",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dfb372a7644373a52c8e607213f9ec2e570bf6d4",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "11f89de1c570ac1000d29e3104c6dec7",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2603a03530bda0c69fd4ed64cf0b7d6f32d224e",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\u0342sP",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\u0342sP",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\u0342sP",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0532"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eb012310d94e4a49e98de2ecd4ca3ee5",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "09b74f795ace1c89b087a845a683a5a1d57e448b",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\u0440",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0532"
        ],
        "tags_summary_labels_fr": [
            "pat-0532"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0002\u0440",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\u0440",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "581f72ea113d53269849f8ff8be1a7cc",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4250d129b5b8a79671944add966e0726a6fa5f02",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdS h",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdS h",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdS h",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "25bf56420684f7c203349a2154090136",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1c661cec3adec5855e2b135474ac23197ca13f54",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{y\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000y\ufffd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{y\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6fc02d9f8cb05e3695cb77cfe1781da7",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf05d6d9df5f8c7941ae08fb74e6d8334a6f8c0b",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionoS@N\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000S@N\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionoS@N\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f0702790c1346ba38ef9e5d5528bd04f",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c0b0bf3dad8ec6bf4d80bc94f54a05d448b78049",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001a\ufffd\u0007",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f5957420b82aa0b02732cf621cfdfa29",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "70557ce8c590b810875bc0c5d226473ccb570d6c",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw\ufffdDW",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0004\ufffdDW",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw\ufffdDW",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "27e55ae80847c399b6ecbaf31743bb38",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d00c3224240c0648fb27ba31da7700317eef6491",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffdW\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdW\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffdW\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "59ca8fbae7f40a85c880fe33fc0d4e0d",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bc1a013f3b6966ebec367aa4201bd3606bde2443",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdH%\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdH%\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdH%\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "725076a49e6f21e527bb104708f59dfd",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2d13f63a7f200e518470e6187ecefc9995a9cb47",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000f\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad78c602a60337d890e1ba9bda3af260",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8587a6d1772bd00eb0349a04b59445a684358700",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw.\ufffdI\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000.\ufffdI\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw.\ufffdI\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1eeb37cb9bc418ad0722f9e7a2561a51",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b0218e71d62ee84ae890ec59f2f98a702d2538e6",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong i\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000 i\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong i\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8887d716e2f19cc09e20e51b7189f928",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c2cff28dfb290a1dcc2112467eb1eeb4c2058cf7",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4d28b6c86627f9a6e9e243a7e0cc9005",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d204cb180952a7f37cc5bed5b5b1f9c0f8bf5e65",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{8\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00008\ufffd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{8\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "64342290c7f1331178b69a598f230859",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c5c93ba5870074062f8582bfa17657fb5f93b93",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione\ufffdD`g",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\ufffdD`g",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione\ufffdD`g",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a7f125a2373c536e0c32765015726529",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3f3e73482a93470b8885c8ab7c4cb223f1bcee11",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd0V",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd0V",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd0V",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "11bbc329614446555b64e82163eddf9f",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "31710c402b09f2dce8311fda405777e42b1c11b2",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{W\ufffdN\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000W\ufffdN\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{W\ufffdN\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4cde33a5a49c113dc7d38e181dfd32a4",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20e454b8bc601d1d137233ccd367aa5a61f3188d",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd^\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd^\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd^\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3d17b66eef299ac2b99446aeb455235e",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "51b1bde491f32ec3cbec6b38f6cb749f4bb43424",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd0",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0001\ufffd0",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd0",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2e36007e0053928cb4eb2fb286af1ab1",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60bf5cdc5f206fc0d56deea03e9f0edc7b27dba2",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffdd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffdd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffdd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "683e6d1e2d0589ad35b4cb0a4c173ff5",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "16bc982d0e3db5ecc23a00b965c271e8f2aef330",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\u0004\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ca151dfd7937557179cb504005a2eb42",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e5ca9e8f5d8e7d8e4cf57cdc1bb47c98ca1f0485",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffd0\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\ufffd0\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffd0\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "664a324d724c08f725744d51826a88cb",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "574925c63d6efcff7500ee5aee830f4ad7a9ff6c",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffdwP)",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffdwP)",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffdwP)",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8ef86e248510a4b49fcb60843cdbc567",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e3458dc4c76bb6f35be9373f5e98e58c17da22d3",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfr8?m",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r8?m",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfr8?m",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "595975762396ee815bb56ce46449d5bb",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c760814f02418786be026718d8ba34915599e2ee",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd\u04fc",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u04fc",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd\u04fc",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ccd224c10c5e3de6d00b55b78b07a0f1",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr\u001e",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr\u001e",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr\u001e",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e9ae2fba03b683e74116de01e95ab08e60a4f038",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdr",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdr",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdr",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f5058f9063c57483a60f9f2a4536420a",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6399042d0bcd3fc29598470e5b785e39da662460",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongC,\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000C,\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongC,\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7d2db7c01b12dbc3b71528eaeb7f4a07",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5016f957d0ff47b5ac39e008857bb39e1b236624",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd1",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd1",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ede9dec1ac12311a02eebb32271e97",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c959dd9145c88123c3b8bd7c8bb0f45edacb3347",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionqn\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\u0015\u000en\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionqn\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.5016291673878235,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b6c0bd73e54286714ae1e7c4a113b807",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp\f",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp\f",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp\f",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "719bfc47f7110a185784c5d8e9d3f67686ffc826",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdp",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffdp",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdp",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "aa269ce58215b2eb3c0940ae956e2788",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "717b29973ca713755e6059cb1d3e040263861d3d",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw\ufffd\ufffd\ufffd",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000w\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionw\ufffd\ufffd\ufffd",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "584a6fe783fda72b980d1a327289a0cd",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b00dc0adcd1e4a5cfe56c884eef6ccd46e6edcc5",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\r\ufffd]",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\r\ufffd]",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\r\ufffd]",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "24452db72b1361ffbbf2270946c695fc",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4692ba4368f8efffcb66fb1dd3ad57f3fb883c1",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\u01ca",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u01ca",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\u01ca",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.584962500721157,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5af3c5a8a40150d3020b4c6a78fc1bf1",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e2e27daa900082eb4816b0cdfaa938200da01228",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffd=",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\u0011\u0013\ufffd=",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffd=",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.312907291846956,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5c730226bf4ca6512932f2b869800468",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f561c4bbd29c5315fe07b088ecd178c6cb2746e4",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione_I,",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000_I,\u0000",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione_I,",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
    "emulator_response_len": 130,
    "bytes_in": 24,
    "payload_entropy": 3.3868421881310122,
    "port_category": "registered",
    "org": "Spruce Creek Networks LLC",
    "service": "bitcoin",
    "app_proto": "bitcoin",
    "asn": 401476,
    "country": "US",
    "dst_port": 8333,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
    "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "bitcoin",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 401476,
        "org": "Spruce Creek Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7aa3f5240ddb6cb761fd6e346763ba25",
        "path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
    },
    "target_context": {
        "dst_port": 8333,
        "service": "bitcoin",
        "service_name": "bitcoin",
        "risk_score": 45
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cryptominer"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ea98c89d6ef9d1bc34dec1210e4c67dba1842e0e",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
        "port": 8333,
        "service": "bitcoin",
        "service_label_fr": "BITCOIN"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongv0vx",
    "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
    "target_port_label": "8333 \u00b7 BITCOIN",
    "emulator_service": "bitcoin",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "bitcoin",
        "service_label_fr": "BITCOIN",
        "dst_port": 8333,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-bitcoin",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000v0vx",
            "port": 8333,
            "service": "bitcoin",
            "service_label_fr": "BITCOIN"
        },
        "attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongv0vx",
        "target_port_label": "8333 \u00b7 BITCOIN",
        "emulator_service": "bitcoin",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (143.20.137.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "bitcoin",
        "service_banner": "honeypot-bitcoin",
        "service_os": "linux",
        "dst_port": "8333"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "143.20.137.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "bitcoin_emulated",
        "bitcoin_version",
        "net_bitcoin_probe"
    ]
}