149.40.49.54

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8855631813716216,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "99d9bdc5cf2de28c0013725440f1d37a",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdC\u001aQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd\u001a`\ufffd\u000fv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\u0002\ufffd\ufffdi\ufffdK\ufffd\u0003\ufffd\ufffdD\ufffd\ufffd\u001d\ufffd\u0013\u0011\ufffd\ufffd\ufffdB\ufffdn\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdC\u001aQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd\u001a`\ufffd\u000fv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\u0002\ufffd\ufffdi\ufffdK\ufffd\u0003\ufffd\ufffdD\ufffd\ufffd\u001d\ufffd\u0013\u0011\ufffd\ufffd\ufffdB\ufffdn\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 N\ufffd\u001b7O\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdC\u001aQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd\u001a`\ufffd\u000fv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\u0002\ufffd\ufffdi\ufffdK\ufffd\u0003\ufffd\ufffdD\ufffd\ufffd\u001d\ufffd\u0013\u0011\ufffd\ufffd\ufffdB\ufffdn\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6fa06677aa9e4cc0d41fd5182343d4d31fd3071a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdC\u001aQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd\u001a`\ufffd\u000fv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\u0002\ufffd\ufffdi\ufffdK\ufffd\u0003\ufffd\ufffdD\ufffd\ufffd\u001d\ufffd\u0013\u0011\ufffd\ufffd\ufffdB\ufffdn\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdCQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd`\ufffdv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\ufffd\ufffdi\ufffdK\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdn\ufffd\\$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdC\u001aQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd\u001a`\ufffd\u000fv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\u0002\ufffd\ufffdi\ufffdK\ufffd\u0003\ufffd\ufffdD\ufffd\ufffd\u001d\ufffd\u0013\u0011\ufffd\ufffd\ufffdB\ufffdn\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdCQYh^\ufffd\ufffd\ufffd\ufffdoE\ufffd`\ufffdv\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdU9b\ufffd\ufffd \ufffd\ufffd+,\ufffdK\ufffd\ufffdi\ufffdK\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdn\ufffd\\$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8093197308017968,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5bcb0ac21cf1f71ea60a279f5cc691d2",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\ufffdM\u0012\ufffd(U\u000b\ufffdaY\ufffdU\ufffd\ufffd\ufffd\u0005{\u0000\ufffd0o\ufffd2\ufffd\ufffd \u000f`l\ufffd= \ufffdQ\ufffd\ufffd\u0001h\ufffd\ufffd\u00e2j0\ufffdE\ufffd\u0010\ufffd]\u000f\ufffd\f\u000b\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\ufffdM\u0012\ufffd(U\u000b\ufffdaY\ufffdU\ufffd\ufffd\ufffd\u0005{\u0000\ufffd0o\ufffd2\ufffd\ufffd \u000f`l\ufffd= \ufffdQ\ufffd\ufffd\u0001h\ufffd\ufffd\u00e2j0\ufffdE\ufffd\u0010\ufffd]\u000f\ufffd\f\u000b\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0007]S(,",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\ufffdM\u0012\ufffd(U\u000b\ufffdaY\ufffdU\ufffd\ufffd\ufffd\u0005{\u0000\ufffd0o\ufffd2\ufffd\ufffd \u000f`l\ufffd= \ufffdQ\ufffd\ufffd\u0001h\ufffd\ufffd\u00e2j0\ufffdE\ufffd\u0010\ufffd]\u000f\ufffd\f\u000b\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "73f6a0d7e51f7af4ff543fe9bab9d51cef21319e",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\ufffdM\u0012\ufffd(U\u000b\ufffdaY\ufffdU\ufffd\ufffd\ufffd\u0005{\u0000\ufffd0o\ufffd2\ufffd\ufffd \u000f`l\ufffd= \ufffdQ\ufffd\ufffd\u0001h\ufffd\ufffd\u00e2j0\ufffdE\ufffd\u0010\ufffd]\u000f\ufffd\f\u000b\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd0\ufffdM\ufffd(U\ufffdaY\ufffdU\ufffd\ufffd\ufffd{\ufffd0o\ufffd2\ufffd\ufffd `l\ufffd= \ufffdQ\ufffd\ufffdh\ufffd\ufffd\u00e2j0\ufffdE\ufffd\ufffd]\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\ufffdM\u0012\ufffd(U\u000b\ufffdaY\ufffdU\ufffd\ufffd\ufffd\u0005{\u0000\ufffd0o\ufffd2\ufffd\ufffd \u000f`l\ufffd= \ufffdQ\ufffd\ufffd\u0001h\ufffd\ufffd\u00e2j0\ufffdE\ufffd\u0010\ufffd]\u000f\ufffd\f\u000b\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd0\ufffdM\ufffd(U\ufffdaY\ufffdU\ufffd\ufffd\ufffd{\ufffd0o\ufffd2\ufffd\ufffd `l\ufffd= \ufffdQ\ufffd\ufffdh\ufffd\ufffd\u00e2j0\ufffdE\ufffd\ufffd]\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdstq$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8604181738931134,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "75b7a3fa6f0b3b551afbb6cad0b92473",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\u0019\u001c\ufffd\u000b6&\u0000C\ufffdf\ufffd0\u0005\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u001f\u06c7\ufffd\ufffd\u00112YV9\ufffd\ufffd\u0010\ufffd\u0004\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\u0019\u001c\ufffd\u000b6&\u0000C\ufffdf\ufffd0\u0005\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u001f\u06c7\ufffd\ufffd\u00112YV9\ufffd\ufffd\u0010\ufffd\u0004\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdoj\u07f7@",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\u0019\u001c\ufffd\u000b6&\u0000C\ufffdf\ufffd0\u0005\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u001f\u06c7\ufffd\ufffd\u00112YV9\ufffd\ufffd\u0010\ufffd\u0004\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25e38f9b02eee93bf4b05fa13f70787e08ae6b6f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\u0019\u001c\ufffd\u000b6&\u0000C\ufffdf\ufffd0\u0005\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u001f\u06c7\ufffd\ufffd\u00112YV9\ufffd\ufffd\u0010\ufffd\u0004\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd6&C\ufffdf\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u06c7\ufffd\ufffd2YV9\ufffd\ufffd\ufffd\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\u0019\u001c\ufffd\u000b6&\u0000C\ufffdf\ufffd0\u0005\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u001f\u06c7\ufffd\ufffd\u00112YV9\ufffd\ufffd\u0010\ufffd\u0004\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd6&C\ufffdf\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdy1\ufffd\ufffdu2\ufffd Y\t\ufffd\u06c7\ufffd\ufffd2YV9\ufffd\ufffd\ufffd\ufffd\ufffd&\u02a3\ufffd\ufffd\ufffd\ufffd\"\u046a\ufffdr$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8621238514128042,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3cf589e5b22d517bd6cb14c652075ea6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdGd\ufffdu\u0019\ufffdn7\ufffd{\ufffd\u001etE\ufffd\ufffd:\ufffd\u0013\u001e\u0011=\ufffdi\ufffd\ufffd#R\u0001\ufffd\ufffd a\ufffd\u0001\ufffd}\u0011H#KJ:\u0002\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\u001b\ufffd\ufffdN<\ufffd\u0011\ufffd\ufffdg\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdGd\ufffdu\u0019\ufffdn7\ufffd{\ufffd\u001etE\ufffd\ufffd:\ufffd\u0013\u001e\u0011=\ufffdi\ufffd\ufffd#R\u0001\ufffd\ufffd a\ufffd\u0001\ufffd}\u0011H#KJ:\u0002\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\u001b\ufffd\ufffdN<\ufffd\u0011\ufffd\ufffdg\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 B\u0016'\ufffd\ufffdY",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdGd\ufffdu\u0019\ufffdn7\ufffd{\ufffd\u001etE\ufffd\ufffd:\ufffd\u0013\u001e\u0011=\ufffdi\ufffd\ufffd#R\u0001\ufffd\ufffd a\ufffd\u0001\ufffd}\u0011H#KJ:\u0002\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\u001b\ufffd\ufffdN<\ufffd\u0011\ufffd\ufffdg\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5632f6f7eac1e920093b157d57235ad438a2bc0e",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdGd\ufffdu\u0019\ufffdn7\ufffd{\ufffd\u001etE\ufffd\ufffd:\ufffd\u0013\u001e\u0011=\ufffdi\ufffd\ufffd#R\u0001\ufffd\ufffd a\ufffd\u0001\ufffd}\u0011H#KJ:\u0002\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\u001b\ufffd\ufffdN<\ufffd\u0011\ufffd\ufffdg\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdGd\ufffdu\ufffdn7\ufffd{\ufffdtE\ufffd\ufffd:\ufffd=\ufffdi\ufffd\ufffd#R\ufffd\ufffd a\ufffd\ufffd}H#KJ:\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\ufffd\ufffdN<\ufffd\ufffd\ufffdg\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdGd\ufffdu\u0019\ufffdn7\ufffd{\ufffd\u001etE\ufffd\ufffd:\ufffd\u0013\u001e\u0011=\ufffdi\ufffd\ufffd#R\u0001\ufffd\ufffd a\ufffd\u0001\ufffd}\u0011H#KJ:\u0002\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\u001b\ufffd\ufffdN<\ufffd\u0011\ufffd\ufffdg\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdGd\ufffdu\ufffdn7\ufffd{\ufffdtE\ufffd\ufffd:\ufffd=\ufffdi\ufffd\ufffd#R\ufffd\ufffd a\ufffd\ufffd}H#KJ:\ufffd\ufffd\ufffd\ufffd\u012d\ufffd\ufffd\ufffdN<\ufffd\ufffd\ufffdg\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8280519250931473,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a4c4af7d0b159478f867aa64964c4d7d",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\ufffd8\ufffd\ufffd\u0007\u0010l5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\u0010\ufffd\ufffd1nS!\ufffd\u0007 \ufffd\ufffdA\ufffd:#\u001f\ufffd\ufffd0\ufffd\u0001\ufffd+\ufffd\u00062\ufffd\u0017E\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\ufffd8\ufffd\ufffd\u0007\u0010l5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\u0010\ufffd\ufffd1nS!\ufffd\u0007 \ufffd\ufffdA\ufffd:#\u001f\ufffd\ufffd0\ufffd\u0001\ufffd+\ufffd\u00062\ufffd\u0017E\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \\Gv\ufffd|z",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\ufffd8\ufffd\ufffd\u0007\u0010l5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\u0010\ufffd\ufffd1nS!\ufffd\u0007 \ufffd\ufffdA\ufffd:#\u001f\ufffd\ufffd0\ufffd\u0001\ufffd+\ufffd\u00062\ufffd\u0017E\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7294a53b349730dc57bc7496c0b0bc21a43c05d8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\ufffd8\ufffd\ufffd\u0007\u0010l5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\u0010\ufffd\ufffd1nS!\ufffd\u0007 \ufffd\ufffdA\ufffd:#\u001f\ufffd\ufffd0\ufffd\u0001\ufffd+\ufffd\u00062\ufffd\u0017E\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd3\ufffd\ufffd8\ufffd\ufffdl5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\ufffd\ufffd1nS!\ufffd \ufffd\ufffdA\ufffd:#\ufffd\ufffd0\ufffd\ufffd+\ufffd2\ufffdE\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\ufffd8\ufffd\ufffd\u0007\u0010l5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\u0010\ufffd\ufffd1nS!\ufffd\u0007 \ufffd\ufffdA\ufffd:#\u001f\ufffd\ufffd0\ufffd\u0001\ufffd+\ufffd\u00062\ufffd\u0017E\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc\u0001\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd3\ufffd\ufffd8\ufffd\ufffdl5\ufffdcpH\\W\ufffd\ufffdZ9\ufffd;\ufffd\ufffd1nS!\ufffd \ufffd\ufffdA\ufffd:#\ufffd\ufffd0\ufffd\ufffd+\ufffd2\ufffdE\ufffd\"E\ufffd\ufffd3\ufffd\ufffd8Kc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8548528760973095,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fc31ab66cb7d132addcbe3b2aa6d470b",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(\ufffd\u0003z\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\u0006\ufffd\n\ufffd\ufffd\u0015\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\u0007\u001b\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd\u001d6\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(\ufffd\u0003z\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\u0006\ufffd\n\ufffd\ufffd\u0015\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\u0007\u001b\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd\u001d6\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 >\ufffd4\ufffd\ufffdK",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(\ufffd\u0003z\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\u0006\ufffd\n\ufffd\ufffd\u0015\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\u0007\u001b\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd\u001d6\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "21a2780f93bd600d9262aa9487307eaa9fb10118",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(\ufffd\u0003z\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\u0006\ufffd\n\ufffd\ufffd\u0015\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\u0007\u001b\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd\u001d6\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd(\ufffdz\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd6$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(\ufffd\u0003z\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\u0006\ufffd\n\ufffd\ufffd\u0015\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\u0007\u001b\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd\u001d6\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd(\ufffdz\ufffd\/\u03fe\ufffd\ufffdy-\ufffd{\u00f0u\uaf60\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd=\ufffd \ufffd|\ufffdJl \ufffd\rg\/3t\ufffd6\ufffd\ufffd=\ufffd\ufffd\u00c1\ufffd]\ufffd\ufffd6$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8897126555715027,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bdd429f72245e02f164b1c18ff8d4a58",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\u0017\ufffd\ufffd\ufffdA\ufffd\u0015{\u0015\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\u0017\ufffd\ufffd\ufffdA\ufffd\u0015{\u0015\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\/\ufffd\ufffd\ufffd4",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\u0017\ufffd\ufffd\ufffdA\ufffd\u0015{\u0015\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ca0656fa00699ef67bd89fffb9b76149fb9ef6ee",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\u0017\ufffd\ufffd\ufffdA\ufffd\u0015{\u0015\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\ufffd\ufffd\ufffdA\ufffd{\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\u0017\ufffd\ufffd\ufffdA\ufffd\u0015{\u0015\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffds^6z\ufffd\"p\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06c0n\ufffdn)\ufffd\ufffd%e\ufffd\ufffd?\ufffd\ufffd\ufffd _x\ufffd\ufffd\ufffdA\ufffd{\ufffd\ufffdqr\ufffd~j<\ufffd\ufffd\ufffd\u015dw\ufffdu.\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.920033076689447,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da7f76725c3df45fb641fa7e1eae82ca",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\u0012I\ufffdM\ufffd5\ufffds9\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0019\u0528\ufffde\ufffdv\u0002\u000e\ufffdn\ufffd\u001f\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\u0012I\ufffdM\ufffd5\ufffds9\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0019\u0528\ufffde\ufffdv\u0002\u000e\ufffdn\ufffd\u001f\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \rW=\ufffd\ufffdS",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\u0012I\ufffdM\ufffd5\ufffds9\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0019\u0528\ufffde\ufffdv\u0002\u000e\ufffdn\ufffd\u001f\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b14bcca2c95cd3d06eb00deaefc30c210e492292",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\u0012I\ufffdM\ufffd5\ufffds9\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0019\u0528\ufffde\ufffdv\u0002\u000e\ufffdn\ufffd\u001f\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffdI\ufffdM\ufffd5\ufffds9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0528\ufffde\ufffdv\ufffdn\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\u0012I\ufffdM\ufffd5\ufffds9\ufffd\u001c\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0019\u0528\ufffde\ufffdv\u0002\u000e\ufffdn\ufffd\u001f\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u02ca\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffdI\ufffdM\ufffd5\ufffds9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u046c\ufffd \u04ba`\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0528\ufffde\ufffdv\ufffdn\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.893387964139955,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4abf058c48c903a81ff5431ad939a864",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdLD\u0012\ufffd\ufffdtL#\u000e\ufffd\ufffdTK\"\ufffd\u001f\ufffd0b8gSi\ufffd]\u0017\ufffd{\ufffd jZ\ufffd\u07bdc\u0000\ufffdNM\u000fe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdLD\u0012\ufffd\ufffdtL#\u000e\ufffd\ufffdTK\"\ufffd\u001f\ufffd0b8gSi\ufffd]\u0017\ufffd{\ufffd jZ\ufffd\u07bdc\u0000\ufffdNM\u000fe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffde\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdLD\u0012\ufffd\ufffdtL#\u000e\ufffd\ufffdTK\"\ufffd\u001f\ufffd0b8gSi\ufffd]\u0017\ufffd{\ufffd jZ\ufffd\u07bdc\u0000\ufffdNM\u000fe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22e9798a84b337262c43691096c9709e6e8250fc",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdLD\u0012\ufffd\ufffdtL#\u000e\ufffd\ufffdTK\"\ufffd\u001f\ufffd0b8gSi\ufffd]\u0017\ufffd{\ufffd jZ\ufffd\u07bdc\u0000\ufffdNM\u000fe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdLD\ufffd\ufffdtL#\ufffd\ufffdTK\"\ufffd\ufffd0b8gSi\ufffd]\ufffd{\ufffd jZ\ufffd\u07bdc\ufffdNMe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdLD\u0012\ufffd\ufffdtL#\u000e\ufffd\ufffdTK\"\ufffd\u001f\ufffd0b8gSi\ufffd]\u0017\ufffd{\ufffd jZ\ufffd\u07bdc\u0000\ufffdNM\u000fe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdLD\ufffd\ufffdtL#\ufffd\ufffdTK\"\ufffd\ufffd0b8gSi\ufffd]\ufffd{\ufffd jZ\ufffd\u07bdc\ufffdNMe\ufffd\ufffd\ufffdArQ\ufffd&K\ufffd}\ufffds8\ufffd\ufffd\ufffdb\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8721113081755223,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f5d80bcdbf9f3afd2938d1ca9a183560",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003m\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u000e\u00f2L\u0004e\ufffd\u0019Fj\ufffdg\u00156J\ufffdZ ?Vm\ufffd&6f?\u0014}\/\ufffddQ\u001b\u012ck\ufffd\ufffdy\u000eV\ufffd\u0002\ufffd\ufffda\ufffd\u0004\u042c\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003m\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u000e\u00f2L\u0004e\ufffd\u0019Fj\ufffdg\u00156J\ufffdZ ?Vm\ufffd&6f?\u0014}\/\ufffddQ\u001b\u012ck\ufffd\ufffdy\u000eV\ufffd\u0002\ufffd\ufffda\ufffd\u0004\u042c\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003m\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u000e\u00f2L\u0004e\ufffd\u0019Fj\ufffdg\u00156J\ufffdZ ?Vm\ufffd&6f?\u0014}\/\ufffddQ\u001b\u012ck\ufffd\ufffdy\u000eV\ufffd\u0002\ufffd\ufffda\ufffd\u0004\u042c\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "945d1c6ea7aee808fe5c1bc079f3a6e2767eb9d3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003m\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u000e\u00f2L\u0004e\ufffd\u0019Fj\ufffdg\u00156J\ufffdZ ?Vm\ufffd&6f?\u0014}\/\ufffddQ\u001b\u012ck\ufffd\ufffdy\u000eV\ufffd\u0002\ufffd\ufffda\ufffd\u0004\u042c\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdm\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u00f2Le\ufffdFj\ufffdg6J\ufffdZ ?Vm\ufffd&6f?}\/\ufffddQ\u012ck\ufffd\ufffdyV\ufffd\ufffd\ufffda\ufffd\u042c$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003m\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u000e\u00f2L\u0004e\ufffd\u0019Fj\ufffdg\u00156J\ufffdZ ?Vm\ufffd&6f?\u0014}\/\ufffddQ\u001b\u012ck\ufffd\ufffdy\u000eV\ufffd\u0002\ufffd\ufffda\ufffd\u0004\u042c\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdm\ufffd\n\ufffdHY\ufffd$\ufffd\ufffdM#\ufffd\ufffd\u00f2Le\ufffdFj\ufffdg6J\ufffdZ ?Vm\ufffd&6f?}\/\ufffddQ\u012ck\ufffd\ufffdyV\ufffd\ufffd\ufffda\ufffd\u042c$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.9165052996580973,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d04d4733f5ba3c2a610793688836bcb8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~\u0013=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPY\u0010q\ufffdG\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~\u0013=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPY\u0010q\ufffdG\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \\\ufffdi\ufffdKV",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~\u0013=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPY\u0010q\ufffdG\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "94a7b3189f9b54a0191e25b392e7c04f0d098318",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~\u0013=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPY\u0010q\ufffdG\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPYq\ufffdG$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~\u0013=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPY\u0010q\ufffdG\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd:\n\ufffd\ufffdfdN\ufffds\ue013nW\ufffd`\ufffdV%\ufffd\ufffd~=\ufffd\ufffd,\ufffd9k q\ufffdG\ufffd\ufffd%\\\ufffd\ufffdmk#T~uc\ufffd\ufffd\ufffdK{\ufffdS|i\ufffdPYq\ufffdG$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ],
    "behavior_alert_count": 2,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8593588607641593,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "78fe4f1191a982ac8857a233f0750824",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdG\u0019B\ufffd&u1G\ufffd&>p\u0016\u0558Ey \ufffdN\u0018~q\ufffdJT\ufffd3\u0316\u0002\ufffd\u0016\ufffd\u00135\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdG\u0019B\ufffd&u1G\ufffd&>p\u0016\u0558Ey \ufffdN\u0018~q\ufffdJT\ufffd3\u0316\u0002\ufffd\u0016\ufffd\u00135\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 8\ufffd\ufffd\ufffd]\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdG\u0019B\ufffd&u1G\ufffd&>p\u0016\u0558Ey \ufffdN\u0018~q\ufffdJT\ufffd3\u0316\u0002\ufffd\u0016\ufffd\u00135\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f67e333d7575621fbaaa414a408f779748ecc582",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdG\u0019B\ufffd&u1G\ufffd&>p\u0016\u0558Ey \ufffdN\u0018~q\ufffdJT\ufffd3\u0316\u0002\ufffd\u0016\ufffd\u00135\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdGB\ufffd&u1G\ufffd&>p\u0558Ey \ufffdN~q\ufffdJT\ufffd3\u0316\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdG\u0019B\ufffd&u1G\ufffd&>p\u0016\u0558Ey \ufffdN\u0018~q\ufffdJT\ufffd3\u0316\u0002\ufffd\u0016\ufffd\u00135\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd9\ufffd\ufffdu\ufffd:\ufffdv>\ufffdGB\ufffd&u1G\ufffd&>p\u0558Ey \ufffdN~q\ufffdJT\ufffd3\u0316\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\u0603(D \ufffdP\ufffd0`$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.895834059638754,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "59638ab7797ebb79919f99dfba8a454e",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u001a\u06f1H\ufffd \/C\u000bL\u001e[\ufffdR\ufffd\ufffd\u001b\ufffd\ufffd U\ufffd:\u0018\u0013\ufffdl\u0018E\ufffd\ufffdq1\ufffd\ufffd\ufffdw\u0018\u0002\ufffd\ufffdnaI\ufffd*\ufffd\u0013\ufffdC\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u001a\u06f1H\ufffd \/C\u000bL\u001e[\ufffdR\ufffd\ufffd\u001b\ufffd\ufffd U\ufffd:\u0018\u0013\ufffdl\u0018E\ufffd\ufffdq1\ufffd\ufffd\ufffdw\u0018\u0002\ufffd\ufffdnaI\ufffd*\ufffd\u0013\ufffdC\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdS\ufffd\ufffd2",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u001a\u06f1H\ufffd \/C\u000bL\u001e[\ufffdR\ufffd\ufffd\u001b\ufffd\ufffd U\ufffd:\u0018\u0013\ufffdl\u0018E\ufffd\ufffdq1\ufffd\ufffd\ufffdw\u0018\u0002\ufffd\ufffdnaI\ufffd*\ufffd\u0013\ufffdC\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c1ca98c39ef5a16c817f8c597060686eda8fbf54",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u001a\u06f1H\ufffd \/C\u000bL\u001e[\ufffdR\ufffd\ufffd\u001b\ufffd\ufffd U\ufffd:\u0018\u0013\ufffdl\u0018E\ufffd\ufffdq1\ufffd\ufffd\ufffdw\u0018\u0002\ufffd\ufffdnaI\ufffd*\ufffd\u0013\ufffdC\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u06f1H\ufffd \/CL[\ufffdR\ufffd\ufffd\ufffd\ufffd U\ufffd:\ufffdlE\ufffd\ufffdq1\ufffd\ufffd\ufffdw\ufffd\ufffdnaI\ufffd*\ufffd\ufffdC\ufffd\\$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u001a\u06f1H\ufffd \/C\u000bL\u001e[\ufffdR\ufffd\ufffd\u001b\ufffd\ufffd U\ufffd:\u0018\u0013\ufffdl\u0018E\ufffd\ufffdq1\ufffd\ufffd\ufffdw\u0018\u0002\ufffd\ufffdnaI\ufffd*\ufffd\u0013\ufffdC\ufffd\\\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u0137e\ufffd\ufffd\ufffd\ufffdR_\ufffd\u06f1H\ufffd \/CL[\ufffdR\ufffd\ufffd\ufffd\ufffd U\ufffd:\ufffdlE\ufffd\ufffdq1\ufffd\ufffd\ufffdw\ufffd\ufffdnaI\ufffd*\ufffd\ufffdC\ufffd\\$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8701711741279667,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "43962b3aa9b4f73be32dab4d39f9a69b",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdH\ufffd\u0132b\u0001\ufffd\ufffdM\u031c\f |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdk\u0010w*i\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdH\ufffd\u0132b\u0001\ufffd\ufffdM\u031c\f |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdk\u0010w*i\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 O\u0004\u000f\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdH\ufffd\u0132b\u0001\ufffd\ufffdM\u031c\f |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdk\u0010w*i\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "790f49904bbd5472e068ee0d1e6c0ec4c2eacc54",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdH\ufffd\u0132b\u0001\ufffd\ufffdM\u031c\f |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdk\u0010w*i\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\u0132b\ufffd\ufffdM\u031c |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdkw*i\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffdH\ufffd\u0132b\u0001\ufffd\ufffdM\u031c\f |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdk\u0010w*i\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd?vi\ufffd+\ufffd\uc188\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\u0132b\ufffd\ufffdM\u031c |#$\ufffd(\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd=\ufffd\ufffd\ufffdkw*i\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8923019501440868,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e6fa1d7968aefb767407cb69181c8414",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffd\u0005i\ufffdA\u0006\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd\u001d@!]o9\u0014\ufffd\ufffd\ufffd\ufffd\rc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffd\u0005i\ufffdA\u0006\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd\u001d@!]o9\u0014\ufffd\ufffd\ufffd\ufffd\rc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0007\ufffd;h\ufffdt",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffd\u0005i\ufffdA\u0006\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd\u001d@!]o9\u0014\ufffd\ufffd\ufffd\ufffd\rc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d8b0ea5a1d9f8c27e627b597600541b681282aaa",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffd\u0005i\ufffdA\u0006\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd\u001d@!]o9\u0014\ufffd\ufffd\ufffd\ufffd\rc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffdi\ufffdA\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd@!]o9\ufffd\ufffd\ufffd\ufffd\rc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffd\u0005i\ufffdA\u0006\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd\u001d@!]o9\u0014\ufffd\ufffd\ufffd\ufffd\rc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdXT\ufffd~ac\ufffd\ufffd\ufffdb\ufffdi\ufffdA\u04f7\ufffd-S?\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdz\ufffd}$\ufffd\u0311\ufffdm\ufffdV\ufffd\ufffd\t\ufffd@!]o9\ufffd\ufffd\ufffd\ufffd\rc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8687669661647126,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01bb6e0435589e63d12277a0481cbd30",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds\u01cd\ufffd\ufffdi\ufffd\u0016\ufffd\ufffdVG9c\u001e\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd\u0004]\ufffd\ufffdg 9K\ufffdmo\ufffd\u0000\n6\u001b\ufffdYB.T\ufffdg\u0002\u001at\ufffdi\u0016\ufffd\ufffdXf2N\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds\u01cd\ufffd\ufffdi\ufffd\u0016\ufffd\ufffdVG9c\u001e\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd\u0004]\ufffd\ufffdg 9K\ufffdmo\ufffd\u0000\n6\u001b\ufffdYB.T\ufffdg\u0002\u001at\ufffdi\u0016\ufffd\ufffdXf2N\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds\u01cd\ufffd\ufffdi\ufffd\u0016\ufffd\ufffdVG9c\u001e\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd\u0004]\ufffd\ufffdg 9K\ufffdmo\ufffd\u0000\n6\u001b\ufffdYB.T\ufffdg\u0002\u001at\ufffdi\u0016\ufffd\ufffdXf2N\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "82c1c90072b4aa7ebd38840800f37eb96c1784a5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds\u01cd\ufffd\ufffdi\ufffd\u0016\ufffd\ufffdVG9c\u001e\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd\u0004]\ufffd\ufffdg 9K\ufffdmo\ufffd\u0000\n6\u001b\ufffdYB.T\ufffdg\u0002\u001at\ufffdi\u0016\ufffd\ufffdXf2N\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffds\u01cd\ufffd\ufffdi\ufffd\ufffd\ufffdVG9c\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd]\ufffd\ufffdg 9K\ufffdmo\ufffd\n6\ufffdYB.T\ufffdgt\ufffdi\ufffd\ufffdXf2N\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffds\u01cd\ufffd\ufffdi\ufffd\u0016\ufffd\ufffdVG9c\u001e\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd\u0004]\ufffd\ufffdg 9K\ufffdmo\ufffd\u0000\n6\u001b\ufffdYB.T\ufffdg\u0002\u001at\ufffdi\u0016\ufffd\ufffdXf2N\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffds\u01cd\ufffd\ufffdi\ufffd\ufffd\ufffdVG9c\ufffd\ufffd\ufffd9\ufffd\u0480\ufffdl\ufffd\ufffd]\ufffd\ufffdg 9K\ufffdmo\ufffd\n6\ufffdYB.T\ufffdgt\ufffdi\ufffd\ufffdXf2N\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.863517576287553,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b5279f24b8ba779c35bbf54707b6bc7a",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a\u0019~\ufffd\u001b61\ufffd\b\ufffd\ufffd\u00d8 \ufffd\ufffdT\u0011\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd\u0000|I\ufffd\u01607\ufffd\ufffd .\u0018\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a\u0019~\ufffd\u001b61\ufffd\b\ufffd\ufffd\u00d8 \ufffd\ufffdT\u0011\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd\u0000|I\ufffd\u01607\ufffd\ufffd .\u0018\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 O\ufffd\u512bP",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a\u0019~\ufffd\u001b61\ufffd\b\ufffd\ufffd\u00d8 \ufffd\ufffdT\u0011\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd\u0000|I\ufffd\u01607\ufffd\ufffd .\u0018\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dbc4d594b5875a022176f8f26f37d8f35b0b22a5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a\u0019~\ufffd\u001b61\ufffd\b\ufffd\ufffd\u00d8 \ufffd\ufffdT\u0011\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd\u0000|I\ufffd\u01607\ufffd\ufffd .\u0018\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a~\ufffd61\ufffd\ufffd\ufffd\u00d8 \ufffd\ufffdT\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd|I\ufffd\u01607\ufffd\ufffd .\ufffd?\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a\u0019~\ufffd\u001b61\ufffd\b\ufffd\ufffd\u00d8 \ufffd\ufffdT\u0011\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd\u0000|I\ufffd\u01607\ufffd\ufffd .\u0018\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffds*t\ufffd\ufffd\ufffd\u028c\ufffda\ufffd\ufffd\ufffd\ufffd\u01b9a~\ufffd61\ufffd\ufffd\ufffd\u00d8 \ufffd\ufffdT\ufffdb\ufffdc\ufffd{m^%,\ufffd\ufffd|I\ufffd\u01607\ufffd\ufffd .\ufffd?\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8628124931606673,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "df3c69d45d9532b2ef29ef243346089d",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u01d5f\ufffdi\ufffdS\u0001&\ufffd2\ufffdc\f\u0005\ufffd<\ufffdq\u0000\\\ufffd\ufffd\ufffd\f0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u001f\u0797\u0002p\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u01d5f\ufffdi\ufffdS\u0001&\ufffd2\ufffdc\f\u0005\ufffd<\ufffdq\u0000\\\ufffd\ufffd\ufffd\f0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u001f\u0797\u0002p\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 9j\ufffd\ufffdn.",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u01d5f\ufffdi\ufffdS\u0001&\ufffd2\ufffdc\f\u0005\ufffd<\ufffdq\u0000\\\ufffd\ufffd\ufffd\f0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u001f\u0797\u0002p\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "875dfb7e8ed8e039373a5ddc4750c2f57abb853a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u01d5f\ufffdi\ufffdS\u0001&\ufffd2\ufffdc\f\u0005\ufffd<\ufffdq\u0000\\\ufffd\ufffd\ufffd\f0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u001f\u0797\u0002p\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\u01d5f\ufffdi\ufffdS&\ufffd2\ufffdc\ufffd<\ufffdq\\\ufffd\ufffd\ufffd0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u0797p$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u01d5f\ufffdi\ufffdS\u0001&\ufffd2\ufffdc\f\u0005\ufffd<\ufffdq\u0000\\\ufffd\ufffd\ufffd\f0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u001f\u0797\u0002p\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u01d5f\ufffdi\ufffdS&\ufffd2\ufffdc\ufffd<\ufffdq\\\ufffd\ufffd\ufffd0*\ufffdb`\ufffd &\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffdK\ufffd\ufffda\ufffd\ufffdAvb\ufffdW>\ufffd\u0797p$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8516733651936716,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "14f674cb2ed4ae52356949df405728ef",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003K\ufffd\b\ufffd\ufffd\ufffd\u0017\ufffd,\ufffdK9{\u0015`\ufffd$P\ufffd\ufffd\u00007 $\ufffde\u001b_\ufffd\ufffd)? \u00194\ufffd\ufffd\u001eH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003K\ufffd\b\ufffd\ufffd\ufffd\u0017\ufffd,\ufffdK9{\u0015`\ufffd$P\ufffd\ufffd\u00007 $\ufffde\u001b_\ufffd\ufffd)? \u00194\ufffd\ufffd\u001eH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdB\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003K\ufffd\b\ufffd\ufffd\ufffd\u0017\ufffd,\ufffdK9{\u0015`\ufffd$P\ufffd\ufffd\u00007 $\ufffde\u001b_\ufffd\ufffd)? \u00194\ufffd\ufffd\u001eH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cf70fed3d5e08cafdd8e66f02bafff7f9a5644f4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003K\ufffd\b\ufffd\ufffd\ufffd\u0017\ufffd,\ufffdK9{\u0015`\ufffd$P\ufffd\ufffd\u00007 $\ufffde\u001b_\ufffd\ufffd)? \u00194\ufffd\ufffd\u001eH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdK9{`\ufffd$P\ufffd\ufffd7 $\ufffde_\ufffd\ufffd)? 4\ufffd\ufffdH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003K\ufffd\b\ufffd\ufffd\ufffd\u0017\ufffd,\ufffdK9{\u0015`\ufffd$P\ufffd\ufffd\u00007 $\ufffde\u001b_\ufffd\ufffd)? \u00194\ufffd\ufffd\u001eH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdK9{`\ufffd$P\ufffd\ufffd7 $\ufffde_\ufffd\ufffd)? 4\ufffd\ufffdH\ufffd\ufffdZ\ufffdO\ufffdg:\ufffd+\ufffd\ufffdYy\ufffd\ufffd![6Q\ufffd\u0156[\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.883661452253622,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0a9b1ea5da4f5ab38d8c44d59a3f17a8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003E\u0019\ufffd\ufffdR)\u0010\u0013\ufffdEC<L.\ufffd\u0002\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\u001a7-\u0005<\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\u001d\ufffd2\ufffd\u0005\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003E\u0019\ufffd\ufffdR)\u0010\u0013\ufffdEC<L.\ufffd\u0002\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\u001a7-\u0005<\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\u001d\ufffd2\ufffd\u0005\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 B\ufffdS\ufffd|",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003E\u0019\ufffd\ufffdR)\u0010\u0013\ufffdEC<L.\ufffd\u0002\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\u001a7-\u0005<\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\u001d\ufffd2\ufffd\u0005\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "df93c03eaa2752edaf9553d902b82d41578b8da3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003E\u0019\ufffd\ufffdR)\u0010\u0013\ufffdEC<L.\ufffd\u0002\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\u001a7-\u0005<\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\u001d\ufffd2\ufffd\u0005\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdE\ufffd\ufffdR)\ufffdEC<L.\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd7-<\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\ufffd2\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003E\u0019\ufffd\ufffdR)\u0010\u0013\ufffdEC<L.\ufffd\u0002\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\u001a7-\u0005<\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\u001d\ufffd2\ufffd\u0005\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdE\ufffd\ufffdR)\ufffdEC<L.\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd7-<\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd\u0468\ufffd\ufffddF\ufffd\ufffd\ud800\udfd3\ufffd:\u044e\ufffd2\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8725419419149647,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7bbec1cb096e1d1116104eec3776b63e",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003'\ufffd\u0002\ufffd\u0011\ufffdNk\ufffdi\ufffd\ufffd\u0012u\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd\u0003 b\ufffdc\ufffd\ufffd\ufffd\u001c&\ufffd\ufffd\u060f\"\ufffd\u0016\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003'\ufffd\u0002\ufffd\u0011\ufffdNk\ufffdi\ufffd\ufffd\u0012u\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd\u0003 b\ufffdc\ufffd\ufffd\ufffd\u001c&\ufffd\ufffd\u060f\"\ufffd\u0016\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 S6\/\ufffd}\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003'\ufffd\u0002\ufffd\u0011\ufffdNk\ufffdi\ufffd\ufffd\u0012u\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd\u0003 b\ufffdc\ufffd\ufffd\ufffd\u001c&\ufffd\ufffd\u060f\"\ufffd\u0016\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "de70c61a33d2d69eafc4482528bdb423390b1062",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003'\ufffd\u0002\ufffd\u0011\ufffdNk\ufffdi\ufffd\ufffd\u0012u\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd\u0003 b\ufffdc\ufffd\ufffd\ufffd\u001c&\ufffd\ufffd\u060f\"\ufffd\u0016\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd'\ufffd\ufffd\ufffdNk\ufffdi\ufffd\ufffdu\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd b\ufffdc\ufffd\ufffd\ufffd&\ufffd\ufffd\u060f\"\ufffd\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003'\ufffd\u0002\ufffd\u0011\ufffdNk\ufffdi\ufffd\ufffd\u0012u\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd\u0003 b\ufffdc\ufffd\ufffd\ufffd\u001c&\ufffd\ufffd\u060f\"\ufffd\u0016\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd'\ufffd\ufffd\ufffdNk\ufffdi\ufffd\ufffdu\ufffd\ufffd\ufffdBv\ufffd\ufffdS\ufffd\ufffd\u06f2\ufffdOF\ufffd b\ufffdc\ufffd\ufffd\ufffd&\ufffd\ufffd\u060f\"\ufffd\ufffd\ufffd_r.\r\ufffd8& q\ufffd0\ufffdE$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8733675491798287,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e82f170ddf0cd938fdef989d023ada46",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+a\ufffd\u0099\u001b\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\u001c\u0002\ufffd\ufffd%q\ufffd\u001a\ufffd\ufffd\/ \ufffd'}\ufffd\u001c\ufffd6\ufffd%\u0707\f\u01d7\ufffda>\ufffdK\ufffd\ufffd}\u000e\u001a`\u008b\ufffd%\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+a\ufffd\u0099\u001b\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\u001c\u0002\ufffd\ufffd%q\ufffd\u001a\ufffd\ufffd\/ \ufffd'}\ufffd\u001c\ufffd6\ufffd%\u0707\f\u01d7\ufffda>\ufffdK\ufffd\ufffd}\u000e\u001a`\u008b\ufffd%\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u027c>>\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+a\ufffd\u0099\u001b\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\u001c\u0002\ufffd\ufffd%q\ufffd\u001a\ufffd\ufffd\/ \ufffd'}\ufffd\u001c\ufffd6\ufffd%\u0707\f\u01d7\ufffda>\ufffdK\ufffd\ufffd}\u000e\u001a`\u008b\ufffd%\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3ae58ab5530811e2cd965174b906f5bc591d6029",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+a\ufffd\u0099\u001b\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\u001c\u0002\ufffd\ufffd%q\ufffd\u001a\ufffd\ufffd\/ \ufffd'}\ufffd\u001c\ufffd6\ufffd%\u0707\f\u01d7\ufffda>\ufffdK\ufffd\ufffd}\u000e\u001a`\u008b\ufffd%\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd+a\ufffd\u0099\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\ufffd\ufffd%q\ufffd\ufffd\ufffd\/ \ufffd'}\ufffd\ufffd6\ufffd%\u0707\u01d7\ufffda>\ufffdK\ufffd\ufffd}`\u008b\ufffd%\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+a\ufffd\u0099\u001b\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\u001c\u0002\ufffd\ufffd%q\ufffd\u001a\ufffd\ufffd\/ \ufffd'}\ufffd\u001c\ufffd6\ufffd%\u0707\f\u01d7\ufffda>\ufffdK\ufffd\ufffd}\u000e\u001a`\u008b\ufffd%\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd+a\ufffd\u0099\u05f6[h\ufffd~\ufffd$\ufffd<\ufffd`x\ufffd\ufffd\ufffd%q\ufffd\ufffd\ufffd\/ \ufffd'}\ufffd\ufffd6\ufffd%\u0707\u01d7\ufffda>\ufffdK\ufffd\ufffd}`\u008b\ufffd%\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8631555382269007,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec94996009bc346c9d032d0c2a2377fa",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ud1bagqA\ufffd\ufffdx\ufffd\u001e\ufffd&\u0000\ufffd\ufffd\ufffdN\u0000.\ufffd\ufffd\ufffd\u0002\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\u000b\ufffd\u07d5i`\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ud1bagqA\ufffd\ufffdx\ufffd\u001e\ufffd&\u0000\ufffd\ufffd\ufffdN\u0000.\ufffd\ufffd\ufffd\u0002\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\u000b\ufffd\u07d5i`\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdy\ufffd\u001cS\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ud1bagqA\ufffd\ufffdx\ufffd\u001e\ufffd&\u0000\ufffd\ufffd\ufffdN\u0000.\ufffd\ufffd\ufffd\u0002\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\u000b\ufffd\u07d5i`\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1c178d4ba9156101527de80c051e183966d0197b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ud1bagqA\ufffd\ufffdx\ufffd\u001e\ufffd&\u0000\ufffd\ufffd\ufffdN\u0000.\ufffd\ufffd\ufffd\u0002\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\u000b\ufffd\u07d5i`\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ud1bagqA\ufffd\ufffdx\ufffd\ufffd&\ufffd\ufffd\ufffdN.\ufffd\ufffd\ufffd\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\ufffd\u07d5i`\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ud1bagqA\ufffd\ufffdx\ufffd\u001e\ufffd&\u0000\ufffd\ufffd\ufffdN\u0000.\ufffd\ufffd\ufffd\u0002\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\u000b\ufffd\u07d5i`\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ud1bagqA\ufffd\ufffdx\ufffd\ufffd&\ufffd\ufffd\ufffdN.\ufffd\ufffd\ufffd\ufffd\ufffdL|L= \ufffd\ufffd\ufffdJ\ufffd K5\ufffd>\ufffd\ufffd\ufffd8L \ufffd0\ufffd6\ufffdz\ufffd\ufffd\ufffd\u07d5i`\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8721056508333738,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8a92c3637a0007b5d0db0688760c0c74",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2\u001e\u001e\u000bG\u0018*0\ufffd_r\ufffd\ufffdns\u0003){y{\u0010\ufffd \ufffdU\u0002(W2\ufffd4\u001e\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd\u0012'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2\u001e\u001e\u000bG\u0018*0\ufffd_r\ufffd\ufffdns\u0003){y{\u0010\ufffd \ufffdU\u0002(W2\ufffd4\u001e\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd\u0012'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 A\ufffdLg\ufffdc",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2\u001e\u001e\u000bG\u0018*0\ufffd_r\ufffd\ufffdns\u0003){y{\u0010\ufffd \ufffdU\u0002(W2\ufffd4\u001e\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd\u0012'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3376d2b8cc152b90720379df0f44b3b443cc3bc8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2\u001e\u001e\u000bG\u0018*0\ufffd_r\ufffd\ufffdns\u0003){y{\u0010\ufffd \ufffdU\u0002(W2\ufffd4\u001e\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd\u0012'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2G*0\ufffd_r\ufffd\ufffdns){y{\ufffd \ufffdU(W2\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2\u001e\u001e\u000bG\u0018*0\ufffd_r\ufffd\ufffdns\u0003){y{\u0010\ufffd \ufffdU\u0002(W2\ufffd4\u001e\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd\u0012'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd3\ufffdP\ufffd+O\u02a4\ufffd2G*0\ufffd_r\ufffd\ufffdns){y{\ufffd \ufffdU(W2\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd1H\ufffd'5\ufffd9O\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8876028020921125,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e792e9f597f2cf0364f57f9e6132b723",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00cc\ufffdw\n\ufffdCT\f\u0012n\ufffds;\ufffd\ufffd\ufffd\ufffd\u001fCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEO\fK\u0004\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00cc\ufffdw\n\ufffdCT\f\u0012n\ufffds;\ufffd\ufffd\ufffd\ufffd\u001fCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEO\fK\u0004\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 :`\ufffd\u06ae\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00cc\ufffdw\n\ufffdCT\f\u0012n\ufffds;\ufffd\ufffd\ufffd\ufffd\u001fCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEO\fK\u0004\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "515c6f94eee8fa4969a3df72e7c6c99e0c24ad51",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00cc\ufffdw\n\ufffdCT\f\u0012n\ufffds;\ufffd\ufffd\ufffd\ufffd\u001fCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEO\fK\u0004\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\u00cc\ufffdw\n\ufffdCTn\ufffds;\ufffd\ufffd\ufffd\ufffdCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEOK\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u00cc\ufffdw\n\ufffdCT\f\u0012n\ufffds;\ufffd\ufffd\ufffd\ufffd\u001fCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEO\fK\u0004\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\u00cc\ufffdw\n\ufffdCTn\ufffds;\ufffd\ufffd\ufffd\ufffdCMy\u06e4Y\ufffd\"\n\t\ufffd\ufffd\ufffd \ufffd6\ufffd\ufffdEOK\ufffd\ufffdZ\ufffdVB\ufffd\ufffd\ufffd1\u00da%v>\ufffdN\ufffd\ufffd\ufffd.\/$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.889062932657224,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e1b57f4f6c092477b5122966f9b42009",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \u0005\ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\u0018\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\u001e\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \u0005\ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\u0018\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\u001e\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0011\ufffdH\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \u0005\ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\u0018\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\u001e\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "481feeadc9a714828b5f43721a2d35f9d7001ae2",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \u0005\ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\u0018\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\u001e\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \u0005\ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\u0018\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\u001e\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd_c5 \ufffd$4%\"\ufffd#\ufffdzE\t\ufffd\ufffdK\ufffdZU=\ufffdj \ufffd,6\ufffdj\ufffd._\ufffd}\ufffd8g\ufffd\ufffd\ufffdR\u017b\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdR?\ufffdy,$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8683104066355605,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "99520721c2b02a27fb782d4e6026a171",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003F\u0012\ufffd\ufffdi\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6k\u0010r)\/=\ufffd\u0019 \ufffd\ufffd&\u0011b\ufffd\ufffd\u01d6P*l\ufffd\ufffd\u0004[oKUc\u0006\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003F\u0012\ufffd\ufffdi\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6k\u0010r)\/=\ufffd\u0019 \ufffd\ufffd&\u0011b\ufffd\ufffd\u01d6P*l\ufffd\ufffd\u0004[oKUc\u0006\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 O \u001f\ufffd\u057c",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003F\u0012\ufffd\ufffdi\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6k\u0010r)\/=\ufffd\u0019 \ufffd\ufffd&\u0011b\ufffd\ufffd\u01d6P*l\ufffd\ufffd\u0004[oKUc\u0006\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f55908ba044a55bf4f8ef8c24354cff656f6a313",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003F\u0012\ufffd\ufffdi\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6k\u0010r)\/=\ufffd\u0019 \ufffd\ufffd&\u0011b\ufffd\ufffd\u01d6P*l\ufffd\ufffd\u0004[oKUc\u0006\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdF\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6kr)\/=\ufffd \ufffd\ufffd&b\ufffd\ufffd\u01d6P*l\ufffd\ufffd[oKUc\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003F\u0012\ufffd\ufffdi\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6k\u0010r)\/=\ufffd\u0019 \ufffd\ufffd&\u0011b\ufffd\ufffd\u01d6P*l\ufffd\ufffd\u0004[oKUc\u0006\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdF\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdhk\ufffd_\ufffdU\ufffd<6kr)\/=\ufffd \ufffd\ufffd&b\ufffd\ufffd\u01d6P*l\ufffd\ufffd[oKUc\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffd4Xk$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.869474149247634,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b0a7fd1a99a844b709a34e5394f9d836",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdg\ufffd\u0001\u000e\ufffd\ufffdX\ufffd\ufffd\ufffd\u001f6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\u000f\ufffd\u0011\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd\u0015)\u07b5\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdg\ufffd\u0001\u000e\ufffd\ufffdX\ufffd\ufffd\ufffd\u001f6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\u000f\ufffd\u0011\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd\u0015)\u07b5\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd$\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdg\ufffd\u0001\u000e\ufffd\ufffdX\ufffd\ufffd\ufffd\u001f6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\u000f\ufffd\u0011\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd\u0015)\u07b5\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6e0924ae31e975cc6277db2cf9bcf0a1459086d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdg\ufffd\u0001\u000e\ufffd\ufffdX\ufffd\ufffd\ufffd\u001f6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\u000f\ufffd\u0011\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd\u0015)\u07b5\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdg\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\ufffd\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd)\u07b5\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdg\ufffd\u0001\u000e\ufffd\ufffdX\ufffd\ufffd\ufffd\u001f6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\u000f\ufffd\u0011\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd\u0015)\u07b5\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdg\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd6\ufffd\ufffdp\ufffd\ufffd\ufffdH\ufffd+\ufffd<\u0327\ufffdP=u 3\ufffdb](\ufffd\ufffd\u078e\ufffd\ufffdy6\ufffdJ0Mkw\ufffd=Oi\ufffd)\u07b5\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8930206070578044,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e278e675d71090690914ad3a9e7e57",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\bd\u0012\u001b\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffd\u001bY\ufffd%\u0018O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\u0017\ufffd\ufffd>\ufffdb\u0018i@\u0553\u0007\ufffdU\u00115\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\bd\u0012\u001b\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffd\u001bY\ufffd%\u0018O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\u0017\ufffd\ufffd>\ufffdb\u0018i@\u0553\u0007\ufffdU\u00115\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd^|\ufffd*#",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\bd\u0012\u001b\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffd\u001bY\ufffd%\u0018O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\u0017\ufffd\ufffd>\ufffdb\u0018i@\u0553\u0007\ufffdU\u00115\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a76abd59b6d7f7220e896b8c5fcc36a70cbb6e4d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\bd\u0012\u001b\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffd\u001bY\ufffd%\u0018O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\u0017\ufffd\ufffd>\ufffdb\u0018i@\u0553\u0007\ufffdU\u00115\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffdY\ufffd%O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\ufffd\ufffd>\ufffdbi@\u0553\ufffdU5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\bd\u0012\u001b\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffd\u001bY\ufffd%\u0018O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\u0017\ufffd\ufffd>\ufffdb\u0018i@\u0553\u0007\ufffdU\u00115\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd9\ufffd\ufffd\ufffdY\ufffd%O\ufffdt7\ufffd-\ufffd\ufffdO \ufffd\ufffd\ufffd>\ufffdbi@\u0553\ufffdU5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8468196526232115,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e5163462c6ffe62928082d822ba53719",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003%\ufffd\u001a\ufffd\ufffd\u000b\ufffd\ufffd\u0003\ufffdN\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\u0000\u0019\ufffd\f \"\u0000\ufffd\ufffdj\ufffd\ufffd\u0014i\ufffd\ufffd\ufffd\ufffd\t\u001d\ufffd\ufffd\ufffd\"\ufffd\ufffd\u000b\ufffd\ufffd\f\ufffd<g\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003%\ufffd\u001a\ufffd\ufffd\u000b\ufffd\ufffd\u0003\ufffdN\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\u0000\u0019\ufffd\f \"\u0000\ufffd\ufffdj\ufffd\ufffd\u0014i\ufffd\ufffd\ufffd\ufffd\t\u001d\ufffd\ufffd\ufffd\"\ufffd\ufffd\u000b\ufffd\ufffd\f\ufffd<g\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0006lkHme",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003%\ufffd\u001a\ufffd\ufffd\u000b\ufffd\ufffd\u0003\ufffdN\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\u0000\u0019\ufffd\f \"\u0000\ufffd\ufffdj\ufffd\ufffd\u0014i\ufffd\ufffd\ufffd\ufffd\t\u001d\ufffd\ufffd\ufffd\"\ufffd\ufffd\u000b\ufffd\ufffd\f\ufffd<g\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "73f531516fa796ab9a892f81bd5b5341b4687b5a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003%\ufffd\u001a\ufffd\ufffd\u000b\ufffd\ufffd\u0003\ufffdN\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\u0000\u0019\ufffd\f \"\u0000\ufffd\ufffdj\ufffd\ufffd\u0014i\ufffd\ufffd\ufffd\ufffd\t\u001d\ufffd\ufffd\ufffd\"\ufffd\ufffd\u000b\ufffd\ufffd\f\ufffd<g\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd%\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\ufffd \"\ufffd\ufffdj\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffd<g\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003%\ufffd\u001a\ufffd\ufffd\u000b\ufffd\ufffd\u0003\ufffdN\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\u0000\u0019\ufffd\f \"\u0000\ufffd\ufffdj\ufffd\ufffd\u0014i\ufffd\ufffd\ufffd\ufffd\t\u001d\ufffd\ufffd\ufffd\"\ufffd\ufffd\u000b\ufffd\ufffd\f\ufffd<g\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd%\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdXA\ufffd\ufffd\ufffd \"\ufffd\ufffdj\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffd<g\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8565497019395356,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b5809513523b7fc00eaf45a1459925bf",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003 \u0000\n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\u0005\ufffd\\m\ufffdPO\u001e\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\u0005\ufffd#6\ufffd~\ufffdO\u0005\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*\u000f\u0016uJ\ufffdr\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003 \u0000\n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\u0005\ufffd\\m\ufffdPO\u001e\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\u0005\ufffd#6\ufffd~\ufffdO\u0005\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*\u000f\u0016uJ\ufffdr\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdc\ufffd+\u001b",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003 \u0000\n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\u0005\ufffd\\m\ufffdPO\u001e\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\u0005\ufffd#6\ufffd~\ufffdO\u0005\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*\u000f\u0016uJ\ufffdr\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a0aa32121c35e5a678e9a520b951087c1011703b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003 \u0000\n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\u0005\ufffd\\m\ufffdPO\u001e\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\u0005\ufffd#6\ufffd~\ufffdO\u0005\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*\u000f\u0016uJ\ufffdr\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd \n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\\m\ufffdPO\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\ufffd#6\ufffd~\ufffdO\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*uJ\ufffdr\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003 \u0000\n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\u0005\ufffd\\m\ufffdPO\u001e\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\u0005\ufffd#6\ufffd~\ufffdO\u0005\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*\u000f\u0016uJ\ufffdr\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd \n6\ufffd\\\ufffd\ufffdQ\ufffdpR\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\\m\ufffdPO\ufffd\ufffd+\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffd\ufffd#6\ufffd~\ufffdO\ufffd0e\ufffd\ufffdQ\ufffd\ufffd<*uJ\ufffdr\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.910696099088626,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2ffd80b57e738b6c989d6c3b698cbe5f",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\u000b\ufffdT\u0010\ufffd\ufffd\u0019\ufffd\ufffd\ufffd` \ufffd\u00129\ufffd^\ufffdh@\ufffd\u001c\ufffd\ufffd\ufffd\u0005o\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\u000b\ufffdT\u0010\ufffd\ufffd\u0019\ufffd\ufffd\ufffd` \ufffd\u00129\ufffd^\ufffdh@\ufffd\u001c\ufffd\ufffd\ufffd\u0005o\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 )\\\ufffd\ufffd\ufffd)",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\u000b\ufffdT\u0010\ufffd\ufffd\u0019\ufffd\ufffd\ufffd` \ufffd\u00129\ufffd^\ufffdh@\ufffd\u001c\ufffd\ufffd\ufffd\u0005o\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7e46c699902dc60eee3334cd01604d3b6af48884",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\u000b\ufffdT\u0010\ufffd\ufffd\u0019\ufffd\ufffd\ufffd` \ufffd\u00129\ufffd^\ufffdh@\ufffd\u001c\ufffd\ufffd\ufffd\u0005o\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdM>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd9\ufffd^\ufffdh@\ufffd\ufffd\ufffd\ufffdo\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\u000b\ufffdT\u0010\ufffd\ufffd\u0019\ufffd\ufffd\ufffd` \ufffd\u00129\ufffd^\ufffdh@\ufffd\u001c\ufffd\ufffd\ufffd\u0005o\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdM>\ufffd\u0307S[\ufffd8W\ufffd*\ufffd2\ufffd\ufffd\ufffdAxm\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd9\ufffd^\ufffdh@\ufffd\ufffd\ufffd\ufffdo\ufffd\u031cQ\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffdk\ufffdx\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8815473370274347,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "26b734c90f57e78411f99590c23d4a19",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003ws\ufffdo\u001b\ufffd\ufffd\ufffd\u001f\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\b\ufffd\ufffd\u001c\ufffd\ufffdW \ufffd\u0003!l']\ufffd\ufffd\ufffd@\"\u001a\\\ufffdG\ufffdL\u0018\u0018\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003ws\ufffdo\u001b\ufffd\ufffd\ufffd\u001f\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\b\ufffd\ufffd\u001c\ufffd\ufffdW \ufffd\u0003!l']\ufffd\ufffd\ufffd@\"\u001a\\\ufffdG\ufffdL\u0018\u0018\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 @\ufffd\ufffdi\u0000m",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003ws\ufffdo\u001b\ufffd\ufffd\ufffd\u001f\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\b\ufffd\ufffd\u001c\ufffd\ufffdW \ufffd\u0003!l']\ufffd\ufffd\ufffd@\"\u001a\\\ufffdG\ufffdL\u0018\u0018\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2e18eb6d924e9268d0c39d61dfdab43270f4109",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003ws\ufffdo\u001b\ufffd\ufffd\ufffd\u001f\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\b\ufffd\ufffd\u001c\ufffd\ufffdW \ufffd\u0003!l']\ufffd\ufffd\ufffd@\"\u001a\\\ufffdG\ufffdL\u0018\u0018\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdws\ufffdo\ufffd\ufffd\ufffd\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffdW \ufffd!l']\ufffd\ufffd\ufffd@\"\\\ufffdG\ufffdL\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003ws\ufffdo\u001b\ufffd\ufffd\ufffd\u001f\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\b\ufffd\ufffd\u001c\ufffd\ufffdW \ufffd\u0003!l']\ufffd\ufffd\ufffd@\"\u001a\\\ufffdG\ufffdL\u0018\u0018\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdws\ufffdo\ufffd\ufffd\ufffd\ufffd\u0707p`L\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffdW \ufffd!l']\ufffd\ufffd\ufffd@\"\\\ufffdG\ufffdL\ufffdI\ufffd\ufffdc\ufffd!4f\ufffd&\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.877264353411363,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3f2ba133ac918125b0cc0bff93283bf7",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u001c\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K\u00198\u0006\ufffd\u000bu2\ufffd \ufffdK\ufffd\u0019xD\t\ufffd'\u001ff\"\ufffdnM\ufffdx\u05df0y\u001b\ufffdV\ufffd\ufffd\u000fp\ufffd\u001f\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u001c\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K\u00198\u0006\ufffd\u000bu2\ufffd \ufffdK\ufffd\u0019xD\t\ufffd'\u001ff\"\ufffdnM\ufffdx\u05df0y\u001b\ufffdV\ufffd\ufffd\u000fp\ufffd\u001f\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd.\ufffd\ufffd&J",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u001c\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K\u00198\u0006\ufffd\u000bu2\ufffd \ufffdK\ufffd\u0019xD\t\ufffd'\u001ff\"\ufffdnM\ufffdx\u05df0y\u001b\ufffdV\ufffd\ufffd\u000fp\ufffd\u001f\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "322342dc2e9152e9d69d5665a7b9e3e4874d1f1a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u001c\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K\u00198\u0006\ufffd\u000bu2\ufffd \ufffdK\ufffd\u0019xD\t\ufffd'\u001ff\"\ufffdnM\ufffdx\u05df0y\u001b\ufffdV\ufffd\ufffd\u000fp\ufffd\u001f\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K8\ufffdu2\ufffd \ufffdK\ufffdxD\t\ufffd'f\"\ufffdnM\ufffdx\u05df0y\ufffdV\ufffd\ufffdp\ufffd\ufffdz$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u001c\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K\u00198\u0006\ufffd\u000bu2\ufffd \ufffdK\ufffd\u0019xD\t\ufffd'\u001ff\"\ufffdnM\ufffdx\u05df0y\u001b\ufffdV\ufffd\ufffd\u000fp\ufffd\u001f\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\u0369*\ufffd\ufffdv~{I\ufffd}K8\ufffdu2\ufffd \ufffdK\ufffdxD\t\ufffd'f\"\ufffdnM\ufffdx\u05df0y\ufffdV\ufffd\ufffdp\ufffd\ufffdz$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8726611024671205,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "28ec223f4642bff76a9789cb3c6032cd",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\u07c8\ufffd\u00a1\/<\ufffd\f4\u04c9\u000e\u0018\ufffd\u0015\u000e\u001a\ufffd\u0016\ufffd5Cn\ufffd\ufffd\f\u0019eB\ufffd \ufffdq\u0006P^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\u07c8\ufffd\u00a1\/<\ufffd\f4\u04c9\u000e\u0018\ufffd\u0015\u000e\u001a\ufffd\u0016\ufffd5Cn\ufffd\ufffd\f\u0019eB\ufffd \ufffdq\u0006P^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 a\ufffd\u0000\ufffd\u0013",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\u07c8\ufffd\u00a1\/<\ufffd\f4\u04c9\u000e\u0018\ufffd\u0015\u000e\u001a\ufffd\u0016\ufffd5Cn\ufffd\ufffd\f\u0019eB\ufffd \ufffdq\u0006P^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "977e7348568beffb4c4a645f3312fc80beea2c07",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\u07c8\ufffd\u00a1\/<\ufffd\f4\u04c9\u000e\u0018\ufffd\u0015\u000e\u001a\ufffd\u0016\ufffd5Cn\ufffd\ufffd\f\u0019eB\ufffd \ufffdq\u0006P^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdD\u07c8\ufffd\u00a1\/<\ufffd4\u04c9\ufffd\ufffd\ufffd5Cn\ufffd\ufffdeB\ufffd \ufffdqP^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\u07c8\ufffd\u00a1\/<\ufffd\f4\u04c9\u000e\u0018\ufffd\u0015\u000e\u001a\ufffd\u0016\ufffd5Cn\ufffd\ufffd\f\u0019eB\ufffd \ufffdq\u0006P^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdD\u07c8\ufffd\u00a1\/<\ufffd4\u04c9\ufffd\ufffd\ufffd5Cn\ufffd\ufffdeB\ufffd \ufffdqP^\ufffd\ufffd8+\ufffd\ufffd\ufffds\ufffd\ufffd#\ufffd\ufffd+\ufffdi\ufffd4\ufffd\ufffd\ufffd\ufffd&Tj\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.87278073714811,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "07871128d4f5f2fc1281d3c7e3a3d1d8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\f\ufffd\ufffd\ufffdq\ufffd=\u001b\u0002\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\\u0017~@\u0001SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~d\u001aP~\ufffd;\ufffdIi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\f\ufffd\ufffd\ufffdq\ufffd=\u001b\u0002\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\\u0017~@\u0001SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~d\u001aP~\ufffd;\ufffdIi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ,P\u0007=\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\f\ufffd\ufffd\ufffdq\ufffd=\u001b\u0002\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\\u0017~@\u0001SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~d\u001aP~\ufffd;\ufffdIi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d884a8c95bb4f6b46b7396dfa7722598b95524ba",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\f\ufffd\ufffd\ufffdq\ufffd=\u001b\u0002\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\\u0017~@\u0001SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~d\u001aP~\ufffd;\ufffdIi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd=\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\~@SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~dP~\ufffd;\ufffdIi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\f\ufffd\ufffd\ufffdq\ufffd=\u001b\u0002\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\\u0017~@\u0001SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~d\u001aP~\ufffd;\ufffdIi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd=\ufffdl\ufffd&[\ufffd\ufffdD_\ufffd\ufffdn.\r\\~@SR\ufffd \ufffd\u49aa[ZyHIFh\ufffd\ufffdZ:\ufffd\u05f33\ufffd~dP~\ufffd;\ufffdIi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8662743698964332,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "31c236d1955f2f79d3c5dbdac4a9232b",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \u000f\ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\u0017\t\u06be\ufffdY\ufffd\b\ufffd\ufffdZ\/r\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \u000f\ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\u0017\t\u06be\ufffdY\ufffd\b\ufffd\ufffdZ\/r\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd%e\ufffdkn",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \u000f\ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\u0017\t\u06be\ufffdY\ufffd\b\ufffd\ufffdZ\/r\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9ca39d05890f855e6a0b51bc141872db77760c69",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \u000f\ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\u0017\t\u06be\ufffdY\ufffd\b\ufffd\ufffdZ\/r\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\t\u06be\ufffdY\ufffd\ufffd\ufffdZ\/r\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \u000f\ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\u0017\t\u06be\ufffdY\ufffd\b\ufffd\ufffdZ\/r\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u07a1\ufffd\ufffdc\u0125\ufffd\ufffdM1\ufffd\ufffd\ufffd@\ufffd\ufffd:\u05beC\ufffd\ufffd;\u7696uj \ufffd\ufffdGk\ufffd\ufffd\n!% `\ufffd\ufffd\u0467\ufffd\t\u06be\ufffdY\ufffd\ufffd\ufffdZ\/r\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.871270961573735,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ecba84500fb4eaf0f68f1e92764f6d52",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003xd0L\u0016\u001c\ufffd\/\ufffdw\ufffd\u0001\ufffd\ufffdO`@\\\u0014,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\u001a\ufffd \ufffdo6G\ufffd\u001b\ufffd\ufffd\ufffd2\ufffde\u0012\"\u0001\u0017'\ufffd\n\ufffdUN-\ufffd\ufffduZ\u0012\ufffd\u0018QH\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003xd0L\u0016\u001c\ufffd\/\ufffdw\ufffd\u0001\ufffd\ufffdO`@\\\u0014,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\u001a\ufffd \ufffdo6G\ufffd\u001b\ufffd\ufffd\ufffd2\ufffde\u0012\"\u0001\u0017'\ufffd\n\ufffdUN-\ufffd\ufffduZ\u0012\ufffd\u0018QH\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\u0019",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003xd0L\u0016\u001c\ufffd\/\ufffdw\ufffd\u0001\ufffd\ufffdO`@\\\u0014,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\u001a\ufffd \ufffdo6G\ufffd\u001b\ufffd\ufffd\ufffd2\ufffde\u0012\"\u0001\u0017'\ufffd\n\ufffdUN-\ufffd\ufffduZ\u0012\ufffd\u0018QH\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e5f84f88d889f259db9315142cd3aa3f06d44b21",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003xd0L\u0016\u001c\ufffd\/\ufffdw\ufffd\u0001\ufffd\ufffdO`@\\\u0014,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\u001a\ufffd \ufffdo6G\ufffd\u001b\ufffd\ufffd\ufffd2\ufffde\u0012\"\u0001\u0017'\ufffd\n\ufffdUN-\ufffd\ufffduZ\u0012\ufffd\u0018QH\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdxd0L\ufffd\/\ufffdw\ufffd\ufffd\ufffdO`@\\,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\ufffd \ufffdo6G\ufffd\ufffd\ufffd\ufffd2\ufffde\"'\ufffd\n\ufffdUN-\ufffd\ufffduZ\ufffdQH$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003xd0L\u0016\u001c\ufffd\/\ufffdw\ufffd\u0001\ufffd\ufffdO`@\\\u0014,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\u001a\ufffd \ufffdo6G\ufffd\u001b\ufffd\ufffd\ufffd2\ufffde\u0012\"\u0001\u0017'\ufffd\n\ufffdUN-\ufffd\ufffduZ\u0012\ufffd\u0018QH\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdxd0L\ufffd\/\ufffdw\ufffd\ufffd\ufffdO`@\\,\ufffd\u044b|<\ufffd\ufffdr\"\ufffd\ufffd \ufffdo6G\ufffd\ufffd\ufffd\ufffd2\ufffde\"'\ufffd\n\ufffdUN-\ufffd\ufffduZ\ufffdQH$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.860876833378301,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b784f9a18c2be20d518c9ed9a87a12db",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\u0007\ufffd\ufffd\u0002\ufffd\u0011\ufffd\u068d\rA\u001d\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\u0016\ufffd=,\ufffd#x\ufffd6-&\u0019t'6\u001f\ufffd\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\u0007\ufffd\ufffd\u0002\ufffd\u0011\ufffd\u068d\rA\u001d\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\u0016\ufffd=,\ufffd#x\ufffd6-&\u0019t'6\u001f\ufffd\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0001}\ufffd1\u0000\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\u0007\ufffd\ufffd\u0002\ufffd\u0011\ufffd\u068d\rA\u001d\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\u0016\ufffd=,\ufffd#x\ufffd6-&\u0019t'6\u001f\ufffd\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "77fdf795c8be526006f92b0948f55e1a8602a423",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\u0007\ufffd\ufffd\u0002\ufffd\u0011\ufffd\u068d\rA\u001d\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\u0016\ufffd=,\ufffd#x\ufffd6-&\u0019t'6\u001f\ufffd\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\ufffd\ufffd\ufffd\ufffd\u068d\rA\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\ufffd=,\ufffd#x\ufffd6-&t'6\ufffd\ufffdz$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\u0007\ufffd\ufffd\u0002\ufffd\u0011\ufffd\u068d\rA\u001d\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\u0016\ufffd=,\ufffd#x\ufffd6-&\u0019t'6\u001f\ufffd\ufffdz\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd8m=W\ufffdxe\ufffd\ufffd\ufffd\ufffdD\ufffd>\ufffd\ufffd\ufffd\ufffd\u068d\rA\ufffd\ufffd\ufffdPI \ufffdT\ufffdr\ufffd\u23a6\"\u0299O^\ufffd=,\ufffd#x\ufffd6-&t'6\ufffd\ufffdz$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.876967965458325,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8f09438efa8aa1f5eec6691f90a2eaa9",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003s\ufffd\ufffd\u0002\u000e\u0011\ufffdM\u0006\ufffd7G\ufffdm\u0012w\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\u000e\ufffd,w\ufffdP\u0019V\ufffdjg\ufffd?\ufffd-\ufffd\u0006\u0007\ufffd\u001d\u0017\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003s\ufffd\ufffd\u0002\u000e\u0011\ufffdM\u0006\ufffd7G\ufffdm\u0012w\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\u000e\ufffd,w\ufffdP\u0019V\ufffdjg\ufffd?\ufffd-\ufffd\u0006\u0007\ufffd\u001d\u0017\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 Z\ufffd\ufffd\ufffd*",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003s\ufffd\ufffd\u0002\u000e\u0011\ufffdM\u0006\ufffd7G\ufffdm\u0012w\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\u000e\ufffd,w\ufffdP\u0019V\ufffdjg\ufffd?\ufffd-\ufffd\u0006\u0007\ufffd\u001d\u0017\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "13ea4131a7179c55b3cf8de883f0b5423e6cf190",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003s\ufffd\ufffd\u0002\u000e\u0011\ufffdM\u0006\ufffd7G\ufffdm\u0012w\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\u000e\ufffd,w\ufffdP\u0019V\ufffdjg\ufffd?\ufffd-\ufffd\u0006\u0007\ufffd\u001d\u0017\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffds\ufffd\ufffd\ufffdM\ufffd7G\ufffdmw\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\ufffd,w\ufffdPV\ufffdjg\ufffd?\ufffd-\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003s\ufffd\ufffd\u0002\u000e\u0011\ufffdM\u0006\ufffd7G\ufffdm\u0012w\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\u000e\ufffd,w\ufffdP\u0019V\ufffdjg\ufffd?\ufffd-\ufffd\u0006\u0007\ufffd\u001d\u0017\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffds\ufffd\ufffd\ufffdM\ufffd7G\ufffdmw\ufffdt\ufffd\u034d\ufffd\/dzh\ufffd\ufffdqA\ufffd \ufffd\ufffd\ufffd>\ufffd}^)\ufffdN\ufffd,w\ufffdPV\ufffdjg\ufffd?\ufffd-\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.862495548723936,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7e15ac6eae5ff817df8e1a1f156de83",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05f6\u0014\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffd\u0016\u0016S\ufffd\ufffd\ufffd\u0017>0qZ\r^\b E8\/~(:}\ufffd\ufffdne\ufffd2V.\u001a|\u0350\u0019m\ufffd\ufffde\u0720\u0012\r\ua13f9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05f6\u0014\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffd\u0016\u0016S\ufffd\ufffd\ufffd\u0017>0qZ\r^\b E8\/~(:}\ufffd\ufffdne\ufffd2V.\u001a|\u0350\u0019m\ufffd\ufffde\u0720\u0012\r\ua13f9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 I\ufffdL\u027c\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05f6\u0014\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffd\u0016\u0016S\ufffd\ufffd\ufffd\u0017>0qZ\r^\b E8\/~(:}\ufffd\ufffdne\ufffd2V.\u001a|\u0350\u0019m\ufffd\ufffde\u0720\u0012\r\ua13f9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8b79c249263f357e381fa0d1d0cc450c90a7197c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05f6\u0014\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffd\u0016\u0016S\ufffd\ufffd\ufffd\u0017>0qZ\r^\b E8\/~(:}\ufffd\ufffdne\ufffd2V.\u001a|\u0350\u0019m\ufffd\ufffde\u0720\u0012\r\ua13f9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\u05f6\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffdS\ufffd\ufffd\ufffd>0qZ\r^ E8\/~(:}\ufffd\ufffdne\ufffd2V.|\u0350m\ufffd\ufffde\u0720\r\ua13f9$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05f6\u0014\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffd\u0016\u0016S\ufffd\ufffd\ufffd\u0017>0qZ\r^\b E8\/~(:}\ufffd\ufffdne\ufffd2V.\u001a|\u0350\u0019m\ufffd\ufffde\u0720\u0012\r\ua13f9\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\u05f6\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ue987\ufffd:\ufffd\ufffdS\ufffd\ufffd\ufffd>0qZ\r^ E8\/~(:}\ufffd\ufffdne\ufffd2V.|\u0350m\ufffd\ufffde\u0720\r\ua13f9$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.870610185416037,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 212238,
    "country": "US",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 212238,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0c89afbffc3e946c6373651538d57753",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015\u001d\ufffd\ufffd\ufffd\u033f\ufffd(}\u0003z\u0014\/\ufffd\u0001u\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 b\u001cJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA\u00141\ufffd\ufffdn\ufffd}\ufffdM\ufffd\u001b5\ufffd\ufffduo\ufffd\ufffd\u0011\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015\u001d\ufffd\ufffd\ufffd\u033f\ufffd(}\u0003z\u0014\/\ufffd\u0001u\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 b\u001cJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA\u00141\ufffd\ufffdn\ufffd}\ufffdM\ufffd\u001b5\ufffd\ufffduo\ufffd\ufffd\u0011\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdc\u0005z\ufffd;",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015\u001d\ufffd\ufffd\ufffd\u033f\ufffd(}\u0003z\u0014\/\ufffd\u0001u\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 b\u001cJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA\u00141\ufffd\ufffdn\ufffd}\ufffdM\ufffd\u001b5\ufffd\ufffduo\ufffd\ufffd\u0011\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f6af798812c82eb7bc087c23d9c68a77e33d7fdf",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015\u001d\ufffd\ufffd\ufffd\u033f\ufffd(}\u0003z\u0014\/\ufffd\u0001u\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 b\u001cJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA\u00141\ufffd\ufffdn\ufffd}\ufffdM\ufffd\u001b5\ufffd\ufffduo\ufffd\ufffd\u0011\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u033f\ufffd(}z\/\ufffdu\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 bJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA1\ufffd\ufffdn\ufffd}\ufffdM\ufffd5\ufffd\ufffduo\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015\u001d\ufffd\ufffd\ufffd\u033f\ufffd(}\u0003z\u0014\/\ufffd\u0001u\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 b\u001cJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA\u00141\ufffd\ufffdn\ufffd}\ufffdM\ufffd\u001b5\ufffd\ufffduo\ufffd\ufffd\u0011\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u033f\ufffd(}z\/\ufffdu\ufffd\ufffd\ufffdR*Ew<\ufffd\ufffd\ufffd\ufffda1 bJe\ufffd4y\ufffd\ufffd\ufffd\ufffdA1\ufffd\ufffdn\ufffd}\ufffdM\ufffd5\ufffd\ufffduo\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}