{"ip":"147.224.218.64","exported_at":"2026-10-26T04:39:01+00:00","period_days":30,"metrics":{"events7d":482,"distinct_ports":1,"distinct_classifications":5,"max_severity":9,"last_sensor_id":"paris-1","max_waf_score":18,"max_risk_score":57,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1083","top_mitre_count":272,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15,"risk_score":51},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499","Upstream"],"tags_summary":["MITRE-T1499","INT-upstream"],"attack_vector":"http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.prettierrc","protocol_details":{"http_method":"GET","http_path":"\/.prettierrc","request_line":"GET \/.prettierrc HTTP\/1.1","http_user_agent":"WebSiphon\/next-0.1","port":8081,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/.prettierrc \u00b7 UA WebSiphon\/next-0.1 \u00b7 HTTP:8081","evidence_snippet":"GET \/.prettierrc HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:8081","target_port_label":"8081 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 1 signal(aux) capteur","classification_reason":"Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab Flood \/ DDoS \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8","payload_preview":"GET \/.prettierrc HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:8081","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"64.218.224.147.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":6038419,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34274,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.prettierrc","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022prettierrc\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022fb5798f43317f01deb44785d79470e9358eed565\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.044335140946818, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u002296a435dedf8868574b4b8bf94ced321619cbf9b1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00222b4c6eaaf9f595d1b9d63814055a2ac8\u0022, \u0022path_pattern_hash\u0022: \u002218ed024a9fe8d02b210c75561aa27829\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.prettierrc\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.prettierrc HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.prettierrc\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.prettierrc HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f306fafe4ec733c7f61f44b88550f2cf2f5838db\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.prettierrc\u0022, \u0022request_line\u0022: \u0022GET \/.prettierrc HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.prettierrc\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.prettierrc\u0022, \u0022request_line\u0022: \u0022GET \/.prettierrc HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.prettierrc\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.prettierrc HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":131},{"id":6038418,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34276,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.eslintrc.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022993c3eafe75ac855ec1c22c5cad263385af0037f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 134, \u0022payload_entropy\u0022: 5.0933145649592015, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u0022a9ab5d8750a4569f45e2939d65825f46f268dab3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002219b970cd2c30c83f6495b05d98f8eb75\u0022, \u0022path_pattern_hash\u0022: \u002290744cc212ca95c2b2dd33b507f71287\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:80\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.eslintrc.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:80\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.eslintrc.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:80\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002266dfd14a043d9ffe9c5fa77b5a0a213ffbd61e1c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.eslintrc.json\u0022, \u0022request_line\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:80\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.eslintrc.json\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.eslintrc.json\u0022, \u0022request_line\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.eslintrc.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.eslintrc.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:80\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":134},{"id":6038417,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34214,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/db.sql","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sql\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00227e2f8d30b2d799ead5e3e6dd113633a88adb6dcc\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 5.132391062551024, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u00220aaa229c0a72663567da6cad23221aa6cce74c4b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022cf8ccc5390fe5a1ac4a540cb079d8af3\u0022, \u0022path_pattern_hash\u0022: \u0022c5effee3516c7896e500ab1ef7dbf14c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/db.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/db.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ec25a2e8b6c2138fe68c7fe1cb39add2713dc64b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db.sql\u0022, \u0022request_line\u0022: \u0022GET \/db.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db.sql\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db.sql\u0022, \u0022request_line\u0022: \u0022GET \/db.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db.sql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":126},{"id":6038416,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34140,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/repo.tar.gz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022gz\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u002218b8d399f69e9fe1d8cfff98cd7665f2421e9a11\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.072551133188885, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u0022a323380ac07ff97e346f447be51c55864a8d7882\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00227109ea410351fbd03573e5d387103cfd\u0022, \u0022path_pattern_hash\u0022: \u0022af5662d9905d01c439ca0dbe1ca11492\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/repo.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/repo.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227c22a252acc7d4555bf57b9ec08bfc377f80e8c0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/repo.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/repo.tar.gz\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/repo.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/repo.tar.gz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/repo.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":131},{"id":6038415,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34268,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.htaccess","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022htaccess\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00223450b1e7f2decdc58edd085ce04b19bc7f5d6fac\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.062162361503826, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226d4e7a0f849371cd57e0baa637073b123852dc27\u0022, \u0022event_fingerprint\u0022: \u0022f5b8f18b7449905aa552505b3cfc0656ebf1d60c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0107\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI Apache htaccess\u0022], \u0022pattern_ids\u0022: [\u0022pat-0107\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022cb5cfde49724b220f03fca1f86e9c260\u0022, \u0022path_pattern_hash\u0022: \u00224c27678faebafe822ea78c9ea1cb1efa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.htaccess\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.htaccess HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.htaccess\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.htaccess HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022146136e1475dfd2b0cf4b76e86165573b4e3ff11\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.htaccess\u0022, \u0022request_line\u0022: \u0022GET \/.htaccess HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.htaccess\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.htaccess\u0022, \u0022request_line\u0022: \u0022GET \/.htaccess HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.htaccess\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.htaccess HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_sensitive_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_sensitive_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":129},{"id":6038414,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34136,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/download.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00220ee35a60d2eb3bb76d83151ce130eb451f7520f7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.12461673358615, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022def4108eb2512f6ec7824cb7b6d8583d35d6e382\u0022, \u0022event_fingerprint\u0022: \u0022c7e80958fcff8f5baf21dfbc44a25c2d8814d6f3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002268c703ffc7f30c8d6658b6cb26e50d0b\u0022, \u0022path_pattern_hash\u0022: \u00228cdbe0562205b76af1313452ed8639de\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/download.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/download.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/download.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/download.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f8b866c7bb395698d25c0c0db8209a317caa62a2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/download.zip\u0022, \u0022request_line\u0022: \u0022GET \/download.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/download.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/download.zip\u0022, \u0022request_line\u0022: \u0022GET \/download.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/download.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/download.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022http_probe_download\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022http_probe_download\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":132},{"id":6038413,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34178,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.tar","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022tar\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00221a0d9c52de933f77ef15f9cca7e4e061a8b18e07\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.108041901981322, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b7ac4c89c5ecd6c4c49753761215a35376000369\u0022, \u0022event_fingerprint\u0022: \u00225d01ae902f8b4124997a3978d19ee4b4808c48f7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022bab8e3cdac62bd76629e02836cfddce5\u0022, \u0022path_pattern_hash\u0022: \u002285b5b15e4a145171fd728ab7e9dd1a40\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.tar\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.tar\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220f4bc45d7c884b31a31db49933fffb57232f2982\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.tar\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.tar\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.tar\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.tar\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.tar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_backup\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_backup\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":6038412,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34122,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/files.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00223a601ccce54c402c01089d99722969fa68c1e267\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.103470892184209, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223073f2bf78706d39f6082890e4a1074d060b5f70\u0022, \u0022event_fingerprint\u0022: \u002293790d11eeeae0c3ba192a7217633d90b2d3a281\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002284e9e4c6713ab7e545d24ab7a14574e8\u0022, \u0022path_pattern_hash\u0022: \u00225ac07474cc33e147f017ed41dc13e3bc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/files.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/files.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ab52444a20ce84af35acdf764850d185b104c43\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files.zip\u0022, \u0022request_line\u0022: \u0022GET \/files.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files.zip\u0022, \u0022request_line\u0022: \u0022GET \/files.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022http_probe_files\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022http_probe_files\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":129},{"id":6038411,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34204,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.sql","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sql\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00220778e66dc91685120fa0e5222b9737c65f736401\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.15451762490414, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022baf97bb1a955f48b4f88dc61bc31387acf746db5\u0022, \u0022event_fingerprint\u0022: \u0022dbc3404a5e1dd290fe59ca777f43d51dc20ef885\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0131\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI SQL backup dump\u0022], \u0022pattern_ids\u0022: [\u0022pat-0131\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022fb51890abff7d67b4cd6898c55f44811\u0022, \u0022path_pattern_hash\u0022: \u00222456a7a22b603c556554665c5d0203f5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022696f318e7d7262c894b7d3e87fefabb225f9beff\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.sql\u0022, \u0022request_line\u0022: \u0022GET \/backup.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.sql\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.sql\u0022, \u0022request_line\u0022: \u0022GET \/backup.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.sql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":6038410,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34188,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.rar","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022rar\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022f2f9f03b3601b7336338491bf39ad6f0e7f252d4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.114938801613936, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221f42976d63b1fd4586f4d056667980eef44d34c7\u0022, \u0022event_fingerprint\u0022: \u0022598bdf43db58ea5db8d45c34f4976cfb4eccf1b8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d99c9f61a7b4d64a2a18fae17e176f31\u0022, \u0022path_pattern_hash\u0022: \u0022bd1d5398eadd6bed94eaa455c320d88f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.rar\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.rar HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.rar\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.rar HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022777523b9ec0fabd2e894e00d3f9529e6d830570e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.rar\u0022, \u0022request_line\u0022: \u0022GET \/backup.rar HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.rar\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.rar\u0022, \u0022request_line\u0022: \u0022GET \/backup.rar HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.rar\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.rar HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":6038409,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34256,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/CNAME","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00229f65db6e084d34f751b7d2feed3309d3e85c5683\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 125, \u0022payload_entropy\u0022: 5.203454689116651, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u0022b70a0d05862fe9ea9d5a0a99fd8e31f95cdfcca7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002258e857eae3e2364ac7efaf5e4619b71d\u0022, \u0022path_pattern_hash\u0022: \u00222a0ea4a3705a0254a1c5c67bad8573ea\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/CNAME\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/CNAME HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/CNAME\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/CNAME HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002240007d6bcd84421ae36bc049c997d461fa2e0d07\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/CNAME\u0022, \u0022request_line\u0022: \u0022GET \/CNAME HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/CNAME\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/CNAME\u0022, \u0022request_line\u0022: \u0022GET \/CNAME HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/CNAME\u0022, \u0022evidence_snippet\u0022: \u0022GET \/CNAME HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":125},{"id":6038408,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34228,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/dump.sql","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sql\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00221fc830e90e8ffa94d6b83234ae2ec2ba7b5108ba\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.161634769907549, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022baf97bb1a955f48b4f88dc61bc31387acf746db5\u0022, \u0022event_fingerprint\u0022: \u002294aee8d03147c329b9d1609e1378c5ca4f1f5a2b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0132\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI SQL dump file\u0022], \u0022pattern_ids\u0022: [\u0022pat-0132\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002259058efdb9a56319778c830e6b48fabe\u0022, \u0022path_pattern_hash\u0022: \u00222debf0ced7dd0a1204edf7447a578b8e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/dump.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/dump.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227785b221f49ae2c4099efc6b48c40b1c3abfab3a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump.sql\u0022, \u0022request_line\u0022: \u0022GET \/dump.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump.sql\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump.sql\u0022, \u0022request_line\u0022: \u0022GET \/dump.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump.sql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/dump.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":128},{"id":6038407,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34272,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.editorconfig","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022editorconfig\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022830f25c1aa82fb4579095db9871f56a613aa38aa\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.075675955309238, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u0022724aa9cf85269dee2825df133c7c77aec03930e3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002244d3912709d7ac17feae01992c6c0029\u0022, \u0022path_pattern_hash\u0022: \u002288c2b1be7266912f4962e28ba415687d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.editorconfig\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.editorconfig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.editorconfig\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.editorconfig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e9081ac8cf7a61a0a458b348f05f41faa95c4524\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.editorconfig\u0022, \u0022request_line\u0022: \u0022GET \/.editorconfig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.editorconfig\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.editorconfig\u0022, \u0022request_line\u0022: \u0022GET \/.editorconfig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.editorconfig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.editorconfig HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":133},{"id":6038406,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34234,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/robots.txt","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2032340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a557365722d6167656e743a202a0a446973616c6c6f77\u0022, \u0022emulator_response_len\u0022: 130, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022txt\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022b7a9adb9fec4116c29da690c45d9a67df535af9d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.081365509486241, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u002213fab51248958103f6082c2a6fbdb20fe44ffc1b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00229892508f444236fdc9476f99379acc24\u0022, \u0022path_pattern_hash\u0022: \u0022adada1317532a28bebf63fe6edbea3e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/robots.txt\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/robots.txt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/robots.txt\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/robots.txt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bf372398fbae02eeb118ee71e6f6ee828f2f7a7c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/robots.txt\u0022, \u0022request_line\u0022: \u0022GET \/robots.txt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/robots.txt\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/robots.txt\u0022, \u0022request_line\u0022: \u0022GET \/robots.txt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/robots.txt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/robots.txt HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":6038405,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34232,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/database.sql","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sql\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022a256b81a49571be3bda096f7ff40f264f6f65ea6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.103604279829895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022baf97bb1a955f48b4f88dc61bc31387acf746db5\u0022, \u0022event_fingerprint\u0022: \u0022f7bff16e36751363723be3081992d4ffa01ac862\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002269a081b00bd1973a3e8107e3c551d3a8\u0022, \u0022path_pattern_hash\u0022: \u00225a42560e1122aec9e65ed81031f076c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/database.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/database.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/database.sql\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/database.sql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229be7733d9ed0efd54b8aa7cdaa042d543cb16a61\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/database.sql\u0022, \u0022request_line\u0022: \u0022GET \/database.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/database.sql\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/database.sql\u0022, \u0022request_line\u0022: \u0022GET \/database.sql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/database.sql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/database.sql HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":132},{"id":6038404,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34240,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/sitemap.xml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203130370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d2231\u0022, \u0022emulator_response_len\u0022: 219, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022xml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022aefeebe85207f9638bc792aa32d2470b82e35120\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.123176586973231, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002266c7a8c51c328d314a575edc7406b2c37886d61f\u0022, \u0022event_fingerprint\u0022: \u0022a618f99afb7b23003501c688ea50f260711c9e10\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00224e4549d2eec5b78d0949c33cbddb0b6a\u0022, \u0022path_pattern_hash\u0022: \u00227efd2a819481844ebcfd47a818831daf\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sitemap.xml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sitemap.xml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002280bf83c345b93f8452a4652a0c85bde93127926e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sitemap.xml\u0022, \u0022request_line\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sitemap.xml\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sitemap.xml\u0022, \u0022request_line\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sitemap.xml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/sitemap.xml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":131},{"id":6038403,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34196,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.7z","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u00227z\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022bdf9e313846a165e6d5acc94b2a2296331719760\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.150253325547303, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221f42976d63b1fd4586f4d056667980eef44d34c7\u0022, \u0022event_fingerprint\u0022: \u0022c51a236b597c5ecff5fe63a6e9576c755d41cbdf\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022c02cad420d356a1925b6981222328032\u0022, \u0022path_pattern_hash\u0022: \u0022386a5a9b902d29e486f6fe3acfee0e96\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.7z\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.7z HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.7z\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.7z HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a80b84c69af05bbfce54279347d4bed63bb63785\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.7z\u0022, \u0022request_line\u0022: \u0022GET \/backup.7z HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.7z\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.7z\u0022, \u0022request_line\u0022: \u0022GET \/backup.7z HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.7z\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.7z HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":129},{"id":6038402,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34152,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/site.tar.gz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022gz\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022bc7e3de439859ad6c0f621410a5933e700ecfda5\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.070653041009596, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u00223b7edbc74b4217b18e2fc78356b3a2ea0c990d58\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00222206bae2bd2c208ed1a8f570ba10b31f\u0022, \u0022path_pattern_hash\u0022: \u0022e3016c27fefdfa8cddc89524754e6240\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/site.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/site.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f3341fd83aa65f7e9ab835a84d15487b61875639\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/site.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/site.tar.gz\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/site.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/site.tar.gz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/site.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":131},{"id":6038401,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34110,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.git.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022c086da9a09b2a68daec0484a7b95552c036b0c7a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.076685477986177, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225966d9cd8295a390f143c4163b66a25eedb23d2a\u0022, \u0022event_fingerprint\u0022: \u0022579f951e62a94fb8ecf7bc95357ebd0c0d74c5e9\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d0f6d971aa22b8a570352528b32bd9d3\u0022, \u0022path_pattern_hash\u0022: \u0022039cce47e49b8882dcdd8f9449e1dc02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.git.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.git.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.git.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.git.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224d10def2a2f78503c1d2a520403c17022878c2d2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.git.zip\u0022, \u0022request_line\u0022: \u0022GET \/.git.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.git.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.git.zip\u0022, \u0022request_line\u0022: \u0022GET \/.git.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.git.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.git.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022http_probe_git\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022http_probe_git\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":128},{"id":6038400,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34156,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/www.tar.gz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022gz\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022d4c6a21dd65fb7c7569591e59d13b79febdaae2c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.123604114183663, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u0022bd53f24ba7a199a823e541e913f0a206b6ed1fa0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022b29815a13da12728c9ec07307d2a10d3\u0022, \u0022path_pattern_hash\u0022: \u00225fa8b6965dec2b447e911bd023f5cb39\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/www.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/www.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bf3e8ee7e37130486d9ff3c028b0e458ce87e6b1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/www.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/www.tar.gz\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/www.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/www.tar.gz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/www.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":6038399,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34144,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/source.tar.gz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022gz\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022c62dc38570f0182b9d6bab5d9bdb82e8cb4832ce\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.085962162484055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u0022dcba6597071aba1654aeaf1d09725baa9a83e32b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022a45b14a3380fb87979bdf0a2ea8c1227\u0022, \u0022path_pattern_hash\u0022: \u002245d6dbb8e6de2124bd58a62cac3c6385\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/source.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/source.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fdae0274ca3fe378dbfc243437de8896b26d208a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/source.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/source.tar.gz\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/source.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/source.tar.gz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/source.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":133},{"id":6038398,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34166,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.tar.gz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022gz\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00225778de785697b4fc4546a4de52844d42f561c56b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.113559199530965, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022baf97bb1a955f48b4f88dc61bc31387acf746db5\u0022, \u0022event_fingerprint\u0022: \u002255f9870d53f1d501c8305e421287bd68384a5f87\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0242\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/backup.tar.gz\u0022], \u0022pattern_ids\u0022: [\u0022pat-0242\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00224b63655157a2a223c15b19c2731e30c3\u0022, \u0022path_pattern_hash\u0022: \u002267a6de18da983dee91c7a271f979eae9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.tar.gz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d5463f8f124a47b46ce3b0204e2d5ba7f9413066\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.tar.gz\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.tar.gz\u0022, \u0022request_line\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.tar.gz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.tar.gz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":133},{"id":6038396,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34010,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/app.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u002279a7000e00dab62f0422f630896b86b16912ce71\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.07768018756156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u002240091e7ddd692bf5ed473b7bd539191c78a6a4d1\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002216e1905e353b83e8d95e7e0a753c8e80\u0022, \u0022path_pattern_hash\u0022: \u0022abf5174ccb268bb8d4461fe6a79434b3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/app.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/app.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220eecd19ce9b06adc3c2360a9c0ebe054ce691956\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app.zip\u0022, \u0022request_line\u0022: \u0022GET \/app.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app.zip\u0022, \u0022request_line\u0022: \u0022GET \/app.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/app.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":127},{"id":6038395,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34038,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/site.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u00225552a5e7db499c61b30aafb8ab8210ba000a9b6c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.076232185094431, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229287c93acc98ac7ba1636c76c89af354854b395d\u0022, \u0022event_fingerprint\u0022: \u0022bfb367e3b272b151609c5982e618aa3ffa6cf6b2\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00228141606ed3c4e93d953c67a2b6b33ece\u0022, \u0022path_pattern_hash\u0022: \u00228931f3347413781760e417d80d7133c1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/site.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/site.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/site.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/site.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dbbdfe38033a7be9e68fd4bf82f32d1ab88ee94f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/site.zip\u0022, \u0022request_line\u0022: \u0022GET \/site.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/site.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/site.zip\u0022, \u0022request_line\u0022: \u0022GET \/site.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/site.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/site.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":128},{"id":6038394,"ip":"147.224.218.64","ts":"2026-10-21 14:57:20.000000","proto":"tcp","src_port":34092,"dst_port":8081,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/backup.zip","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022zip\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022120464334a09253351ef1d72ea024ff0a6ce1548\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.120745628553655, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b7ac4c89c5ecd6c4c49753761215a35376000369\u0022, \u0022event_fingerprint\u0022: \u002278368974a7132959bb4176c97b486c1e533e7b6e\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0243\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/backup.zip\u0022], \u0022pattern_ids\u0022: [\u0022pat-0243\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00220f58186d4f704144a53d636981b8d815\u0022, \u0022path_pattern_hash\u0022: \u0022971e61c28ff9d3ddfc07b15126d7c0c7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup.zip\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/backup.zip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228bdbfa5d91de3f133044443da31d611b69120090\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.zip\u0022, \u0022request_line\u0022: \u0022GET \/backup.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.zip\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup.zip\u0022, \u0022request_line\u0022: \u0022GET \/backup.zip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8081 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup.zip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup.zip HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8081\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_backup\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_backup\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":130}],"total_events":482}