147.185.132.219

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
    "emulator_response_len": 37,
    "bytes_in": 1483,
    "payload_entropy": 7.717927502707221,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "elite",
    "app_proto": "elite",
    "asn": 396982,
    "country": "US",
    "dst_port": 31337,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "1156c7378241b4822d39ec38bf8d9c9211c21a28",
    "event_fingerprint": "7476baba50c40221e6be25a2178d5866bd6087e1",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "elite",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0b9a3c097f4ac1847a92b5c8b824d238",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 31337,
        "service": "elite",
        "service_name": "elite",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013H!\u0006\ufffd\u001d\n\ufffd\u049aLu\ufffd\u001f\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\u001e\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb\u0001\f#}:\ufffd\u0000\ufffd\ufffd{\ufffd\ufffd\u000f\ufffd\u0016|\ufffd\ufffd\u0015z\u0013\u001a\ufffd\u0011\ufffd!\ufffd\ufffd;\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013H!\u0006\ufffd\u001d\n\ufffd\u049aLu\ufffd\u001f\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\u001e\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb\u0001\f#}:\ufffd\u0000\ufffd\ufffd{\ufffd\ufffd\u000f\ufffd\u0016|\ufffd\ufffd\u0015z\u0013\u001a\ufffd\u0011\ufffd!\ufffd\ufffd;\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\t\ufffd\u001b\u000f\ufffd\u001cN\ufffdV\u001a%\u0017\u02b1\ufffd\ufffd\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013H!\u0006\ufffd\u001d\n\ufffd\u049aLu\ufffd\u001f\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\u001e\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb\u0001\f#}:\ufffd\u0000\ufffd\ufffd{\ufffd\ufffd\u000f\ufffd\u0016|\ufffd\ufffd\u0015z\u0013\u001a\ufffd\u0011\ufffd!\ufffd\ufffd;\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a7d54ab2d20ca98dca48e9504eb3ff9abdd31881",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013H!\u0006\ufffd\u001d\n\ufffd\u049aLu\ufffd\u001f\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\u001e\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb\u0001\f#}:\ufffd\u0000\ufffd\ufffd{\ufffd\ufffd\u000f\ufffd\u0016|\ufffd\ufffd\u0015z\u0013\u001a\ufffd\u0011\ufffd!\ufffd\ufffd;\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "port": 31337,
        "service": "elite",
        "service_label_fr": "ELITE"
    },
    "evidence_snippet": "\ufffd\ufffdH!\ufffd\n\ufffd\u049aLu\ufffd\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb#}:\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd|\ufffd\ufffdz\ufffd\ufffd!\ufffd\ufffd;\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
    "attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
    "target_port_label": "31337 \u00b7 ELITE",
    "emulator_service": "elite",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "elite",
        "service_label_fr": "ELITE",
        "dst_port": 31337,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-elite",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013H!\u0006\ufffd\u001d\n\ufffd\u049aLu\ufffd\u001f\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\u001e\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb\u0001\f#}:\ufffd\u0000\ufffd\ufffd{\ufffd\ufffd\u000f\ufffd\u0016|\ufffd\ufffd\u0015z\u0013\u001a\ufffd\u0011\ufffd!\ufffd\ufffd;\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
            "port": 31337,
            "service": "elite",
            "service_label_fr": "ELITE"
        },
        "attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdH!\ufffd\n\ufffd\u049aLu\ufffd\ufffd\ufffd\ufffd\u00c7\ufffd\\\ufffd&\ufffd1E[\ufffd\ufffd\ufffdh \ufffdb#}:\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd|\ufffd\ufffdz\ufffd\ufffd!\ufffd\ufffd;\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
        "target_port_label": "31337 \u00b7 ELITE",
        "emulator_service": "elite",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elite",
        "service_banner": "honeypot-elite",
        "service_os": "linux",
        "dst_port": "31337"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
    "emulator_response_len": 37,
    "bytes_in": 207,
    "payload_entropy": 4.949004966974795,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "elite",
    "app_proto": "elite",
    "asn": 396982,
    "country": "US",
    "dst_port": 31337,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "1156c7378241b4822d39ec38bf8d9c9211c21a28",
    "event_fingerprint": "7476baba50c40221e6be25a2178d5866bd6087e1",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "elite",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "23367ad939316296d52c7671988314d7",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "795bc7ce13f60d61e9ac03611dd36d90",
        "ja4": "bcc542a5296d13201e694c8f5aa448d9",
        "tls_version": "0x0303",
        "tls_cipher_count": 52,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "795bc7ce13f60d61e9ac03611dd36d90",
    "tls_ja3": "771,52244-52243-49199-49195-49200-49196-49169-49159-49191-49187-49171-49161-49192-49188-49172-49162-52245-158-159-103-107-51-57-156-157-5-4-60-61-47-53-49170-22-10-3-8-6-20-17-25-23-50-49160-18-19-21-56-64-102-106-162-163,5-10-11-13-65281-15,23-24-25,0",
    "tls_ja4_hash": "bcc542a5296d13201e694c8f5aa448d9",
    "tls_ja4": "t13d0152_4fb103f5e16c_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 52,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 31337,
        "service": "elite",
        "service_name": "elite",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00b6\ufffd\ufffd\ufffd\u0004\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\u0017\ufffd$%\ufffd i\u0010s\ufffd\ufffd\u0018\u001b\u0000\u0000h\ufffd\u0014\ufffd\u0013\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\u0011\ufffd\u0007\ufffd'\ufffd#\ufffd\u0013\ufffd\t\ufffd(\ufffd$\ufffd\u0014\ufffd\n\ufffd\u0015\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000<\u0000=\u0000\/\u00005\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0003\u0000\b\u0000\u0006\u0000\u0014\u0000\u0011\u0000\u0019\u0000\u0017",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00b6\ufffd\ufffd\ufffd\u0004\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\u0017\ufffd$%\ufffd i\u0010s\ufffd\ufffd\u0018\u001b\u0000\u0000h\ufffd\u0014\ufffd\u0013\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\u0011\ufffd\u0007\ufffd'\ufffd#\ufffd\u0013\ufffd\t\ufffd(\ufffd$\ufffd\u0014\ufffd\n\ufffd\u0015\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000<\u0000=\u0000\/\u00005\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0003\u0000\b\u0000\u0006\u0000\u0014\u0000\u0011\u0000\u0019\u0000\u0017\u00002\ufffd\b\u0000\u0012\u0000\u0013\u0000\u0015\u00008\u0000@\u0000f\u0000j\u0000\ufffd\u0000\ufffd\u0001\u0000\u00005\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\f\u0000\n\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0002\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u000f\u0000\u0001\u0001",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00b6\ufffd\ufffd\ufffd\u0004\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\u0017\ufffd$%\ufffd i\u0010s\ufffd\ufffd\u0018\u001b\u0000\u0000h\ufffd\u0014\ufffd\u0013\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\u0011\ufffd\u0007\ufffd'\ufffd#\ufffd\u0013\ufffd\t\ufffd(\ufffd$\ufffd\u0014\ufffd\n\ufffd\u0015\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000<\u0000=\u0000\/\u00005\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0003\u0000\b\u0000\u0006\u0000\u0014\u0000\u0011\u0000\u0019\u0000\u0017",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98d97769e958a035ba5c8e22854dc206339f5614",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00b6\ufffd\ufffd\ufffd\u0004\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\u0017\ufffd$%\ufffd i\u0010s\ufffd\ufffd\u0018\u001b\u0000\u0000h\ufffd\u0014\ufffd\u0013\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\u0011\ufffd\u0007\ufffd'\ufffd#\ufffd\u0013\ufffd\t\ufffd(\ufffd$\ufffd\u0014\ufffd\n\ufffd\u0015\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000<\u0000=\u0000\/\u00005\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0003\u0000\b\u0000\u0006\u0000\u0014\u0000\u0011\u0000\u0019\u0000\u0017",
        "tls_ja3": "795bc7ce13f60d61e9ac03611dd36d90",
        "tls_ja4": "bcc542a5296d13201e694c8f5aa448d9",
        "port": 31337,
        "service": "elite",
        "service_label_fr": "ELITE"
    },
    "evidence_snippet": "\ufffd\ufffd\u00b6\ufffd\ufffd\ufffd\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\ufffd$%\ufffd is\ufffd\ufffdh\ufffd\ufffd\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\ufffd\ufffd'\ufffd#\ufffd\ufffd\t\ufffd(\ufffd$\ufffd\ufffd\n\ufffd\ufffd\ufffdgk39\ufffd\ufffd<=\/5\ufffd",
    "attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
    "target_port_label": "31337 \u00b7 ELITE",
    "emulator_service": "elite",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "elite",
        "service_label_fr": "ELITE",
        "dst_port": 31337,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-elite",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00b6\ufffd\ufffd\ufffd\u0004\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\u0017\ufffd$%\ufffd i\u0010s\ufffd\ufffd\u0018\u001b\u0000\u0000h\ufffd\u0014\ufffd\u0013\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\u0011\ufffd\u0007\ufffd'\ufffd#\ufffd\u0013\ufffd\t\ufffd(\ufffd$\ufffd\u0014\ufffd\n\ufffd\u0015\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000<\u0000=\u0000\/\u00005\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0003\u0000\b\u0000\u0006\u0000\u0014\u0000\u0011\u0000\u0019\u0000\u0017",
            "tls_ja3": "795bc7ce13f60d61e9ac03611dd36d90",
            "tls_ja4": "bcc542a5296d13201e694c8f5aa448d9",
            "port": 31337,
            "service": "elite",
            "service_label_fr": "ELITE"
        },
        "attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u00b6\ufffd\ufffd\ufffd\ufffdxA\ufffd\ufffd\ufffd\ufffd\u013abQ\ufffd$%\ufffd is\ufffd\ufffdh\ufffd\ufffd\ufffd\/\ufffd+\ufffd0\ufffd,\ufffd\ufffd\ufffd'\ufffd#\ufffd\ufffd\t\ufffd(\ufffd$\ufffd\ufffd\n\ufffd\ufffd\ufffdgk39\ufffd\ufffd<=\/5\ufffd",
        "target_port_label": "31337 \u00b7 ELITE",
        "emulator_service": "elite",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elite",
        "service_banner": "honeypot-elite",
        "service_os": "linux",
        "dst_port": "31337"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 216,
    "payload_entropy": 5.084664271113836,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 396982,
    "country": "US",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "4fe863cd9c1229e5de4e616da4a1fcd9f9c77f2e",
    "event_fingerprint": "fcd9ad3af467fbbcb2cfd91fbb3debdbd108dae8",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0460"
    ],
    "classification_reason": "Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 45
    },
    "service_name": "kerberos",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "54f396335ed819fc85bbcfe54662dfa7",
        "path_pattern_hash": "64fbc3aee24db4a0fc1ea9e5fbb0e29c"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 45
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
        "classification_reason": "Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e0e28ccd294c39c417421c80d5fdbd74bb3be21f",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
    "attack_vector": "mongodb probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0460"
        ],
        "tags_summary_labels_fr": [
            "pat-0460"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "mongodb probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-co",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mongodb_hello_probe",
        "net_mongodb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "689bfbab10519e1ecf247982c128c7460ee59d4d",
    "http_host_hash": "5af561107125d8ccc4aac442a3b8b5dee6769a85",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 218,
    "payload_entropy": 5.100647144002227,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "dst_port": 8088,
    "risk_waf": 57.5,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.6,
    "risk_breakdown": {
        "waf": 57.5,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 48,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "d026eed22cf0b199d5dd42b3f72f975d04a2a5a8",
    "event_fingerprint": "1548d2e65d9d927300f92b0ba6e8f85fcbc735e2",
    "classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 147,
    "precision_signals": [
        "INT-scanner-palo-alto",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-scanner-palo-alto",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0460"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "UA Palo Alto Networks"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0460"
    ],
    "confidence_breakdown": {
        "waf": 57.5,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ce3935d92be5f9290d282e51ab604b41",
        "payload_hash": "10f33c917607ac1283290d271c2f3c15",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8088,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-",
    "method": "GET",
    "path": "\/",
    "user_agent": "Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity",
    "waf_tags": [
        "950318:lfi-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity",
        "waf_tags": [
            "950318:lfi-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpanse\/Scanning-activity\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-",
        "classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7db6400cc43cd31c0a6ff4fb0df34f7f243ee4db",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpa\u2026",
        "port": 8088,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-",
    "attack_vector": "web scanner \u00b7 via HTTP:8088 \u00b7 (sonde \/ probe)",
    "target_port_label": "8088 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
        "classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 57.5,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8088,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-scanner-palo-alto",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Scanner Palo Alto",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-cortex.paloaltonetworks.com\/r\/1\/Cortex-Xpa\u2026",
            "port": 8088,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "web scanner \u00b7 via HTTP:8088 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Hello from Palo Alto Networks, find out more about our scans in https:\/\/docs-",
        "target_port_label": "8088 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 57 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8088"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950318:lfi-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_ua_disclosed_scanner",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Google LLC",
    "service": null,
    "app_proto": null,
    "asn": 396982,
    "country": "US",
    "dst_port": 2002,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "86baa3b7b82f06868273e7c318af616e3d5240bb",
    "event_fingerprint": "6675680bd243682debee57f0f931a6cd3d55fbc9",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2002,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a0cae3ed55ff19654643d1093455a56537d44619",
    "protocol_details": {
        "port": 2002
    },
    "attack_vector": "Sonde port \u00b7 port 2002 \u00b7 (sonde \/ probe)",
    "target_port_label": "2002",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2002,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 2002
        },
        "attack_vector": "Sonde port \u00b7 port 2002 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2002",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "300c02010161070a010004000400",
    "emulator_response_len": 14,
    "bytes_in": 65,
    "payload_entropy": 3.9342801321240977,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "ldap",
    "app_proto": "ldap",
    "asn": 396982,
    "country": "US",
    "dst_port": 389,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "8dc55d1a82672315dc33e841a4ca6429af59a73e",
    "event_fingerprint": "e2ae41afc8a35e69ecf9bb72012d15ecccc001d6",
    "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0859",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0859",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0859",
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "ET LDAP anon bind",
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0859",
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "ldap",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "31796e3a5f1c37830a8ffaad01bef259",
        "path_pattern_hash": "79ba87c92cce1f6abf5b6560fb8afdba"
    },
    "target_context": {
        "dst_port": 389,
        "service": "ldap",
        "service_name": "ldap",
        "risk_score": 48
    },
    "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d4b1a5b8a474fdbfaf216fc8c3b8c78082d0c29",
    "protocol_details": {
        "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "port": 389,
        "service": "ldap",
        "service_label_fr": "LDAP"
    },
    "evidence_snippet": "0`\ufffd0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd",
    "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
    "target_port_label": "389 \u00b7 LDAP",
    "emulator_service": "ldap",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ldap",
        "service_label_fr": "LDAP",
        "dst_port": 389,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0859",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0859",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ldap",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000\ufffd\u00000\ufffd\u0000\u0000\u0000-\u0002\u0001\u0002c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
            "port": 389,
            "service": "ldap",
            "service_label_fr": "LDAP"
        },
        "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "0`\ufffd0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd",
        "target_port_label": "389 \u00b7 LDAP",
        "emulator_service": "ldap",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (147.185.132.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ldap",
        "service_banner": "honeypot-ldap",
        "service_os": "linux",
        "dst_port": "389"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "147.185.132.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "ldap_bind",
        "ldap_bind_probe",
        "ldap_emulated",
        "net_ldap_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
    "emulator_response_len": 33,
    "bytes_in": 41,
    "payload_entropy": 2.6815242952410756,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "mssql",
    "app_proto": "mssql",
    "asn": 396982,
    "country": "US",
    "dst_port": 1433,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 10
    },
    "risk_score": 35,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "584dc8ab43572550a5af46f03637ac724e8c86c3",
    "event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 10,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "mssql",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3acc3d5dfc994aab3ac70f92a2b0e916",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 1433,
        "service": "mssql",
        "service_name": "mssql",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\t\u0000\u0005w\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\t\u0000\u0005w\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\t\u0000\u0005w\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\t\u0000\u0005w\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\t\u0000\u0005w\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "24b8f524c37c4a2f2af2175c6474941eec8af0c6",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 10,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "mssql",
        "service_label_fr": "MSSQL",
        "dst_port": 1433,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mssql",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mssql",
        "service_banner": "honeypot-mssql",
        "service_os": "linux",
        "dst_port": "1433"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_emulated",
        "mssql_payload",
        "mssql_probe",
        "mssql_tds",
        "net_mssql_tds"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "daytime",
    "app_proto": "daytime",
    "asn": 396982,
    "country": "US",
    "dst_port": 13,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cc6381cd700f75418f79cfb2b833f5dc4a499b4c",
    "event_fingerprint": "703dc9cbe3a71599c9ad28e77f198e0b38a2e436",
    "classification_reason": "Type \u00ab daytime \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd",
        "path_pattern_hash": "49df1e5699a297cb2411878fd2df9841"
    },
    "target_context": {
        "dst_port": 13,
        "service": "daytime"
    },
    "payload_preview": "\r\n\r\n",
    "request_sample": "\r\n\r\n",
    "evidence": {
        "request_sample": "\r\n\r\n",
        "classification_reason": "Type \u00ab daytime \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "75484059fdb001033b921d9b181dbf9ae62d8bc8",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "daytime",
    "app_proto": "daytime",
    "asn": 396982,
    "country": "US",
    "dst_port": 13,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cc6381cd700f75418f79cfb2b833f5dc4a499b4c",
    "event_fingerprint": "703dc9cbe3a71599c9ad28e77f198e0b38a2e436",
    "classification_reason": "Type \u00ab daytime \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49df1e5699a297cb2411878fd2df9841"
    },
    "target_context": {
        "dst_port": 13,
        "service": "daytime"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8f484deaf666fdf121c040e713bef518e61668e9",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 18,
    "payload_entropy": 3.1279868068776753,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "mqtt",
    "app_proto": "mqtt",
    "asn": 396982,
    "country": "US",
    "risk_waf": 0,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_breakdown": {
        "waf": 0,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 14,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0d65484148f9793655bb581277303ea528f89944",
    "event_fingerprint": "cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "43416b3e61efdaf5f74b5a80080725f3",
        "path_pattern_hash": "4449b927317468afa12a2f935a413459"
    },
    "target_context": {
        "dst_port": 1883,
        "service": "mqtt"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.68,
    "classification_confidence": 0.68,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0010\u0010\u0000\u0004MQTT\u0004\u0000\u0000\u001e\u0000\u0004test",
    "event_signature": "18962bb5c33992d6709c5379dc18284207e31b5d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mqtt_connect"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "689bfbab10519e1ecf247982c128c7460ee59d4d",
    "http_host_hash": "56065ca668d8d7f7485c830c7fa4db1351219001",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 219,
    "payload_entropy": 5.108059523507308,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "tag_count": 4,
    "anomaly_count": 0,
    "risk_score": 100,
    "campaign_key": "0cbed412cc82054c14b1f454a14e9426e19a100c",
    "event_fingerprint": "c058d632fbfbc0626594b92dae27203392b4ebf1",
    "tags_list": [
        "950318:lfi-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "689bfbab10519e1ecf247982c128c7460ee59d4d",
    "http_host_hash": "dabc956513ff5f70f98740dd81aec2d25651889a",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 217,
    "payload_entropy": 5.1036331775748005,
    "port_category": "well_known",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "tag_count": 4,
    "anomaly_count": 0,
    "risk_score": 100,
    "campaign_key": "c04002c4c6fa40ff794b31fb2e0413b400afe546",
    "event_fingerprint": "601bc66a0576b36bfb80c404245ed59e79ad3bdf",
    "tags_list": [
        "950318:lfi-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "689bfbab10519e1ecf247982c128c7460ee59d4d",
    "http_host_hash": "484629fbfedce591fd570c43c91ddc8f3cbc73ab",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 218,
    "payload_entropy": 5.100647144002227,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "US",
    "tag_count": 4,
    "anomaly_count": 0,
    "risk_score": 100,
    "campaign_key": "5dc1a5fa114130cd97ada022e9306ea420b250bf",
    "event_fingerprint": "e7aa3deaadb03b61331a5255954d3b45fd1b4007",
    "tags_list": [
        "950318:lfi-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}