{"ip":"15.160.137.85","exported_at":"2026-07-26T05:09:24+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":84,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1499","top_mitre_count":3708,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30,"risk_score":80},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499"],"tags_summary":["MITRE-T1499"],"attack_vector":"http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold","protocol_details":{"http_method":"GET","http_path":"\/aws%2ephp%2eold","request_line":"GET \/aws%2ephp%2eold HTTP\/1.1","http_user_agent":"curl\/8.7.1","port":7445,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/aws%2ephp%2eold \u00b7 UA curl\/8.7.1 \u00b7 HTTP:7445","evidence_snippet":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7445\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag","target_port_label":"7445 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 5 tag(s) WAF","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","classification_reason_label_fr":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF","payload_preview":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7445\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag"},"events":[{"id":12599253,"ip":"15.160.137.85","ts":"2026-07-16 22:32:32.000000","proto":"tcp","src_port":7940,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_nodes\/http","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022ff6b945c65ec0157356b158dad63a07259b32811\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.169307292884398, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u0022e8c58e4dca16c8864a449879bdbc98955e395f83\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ES nodes API\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dba81dcccdce5f86be62cc3c7b6072aa\u0022, \u0022path_pattern_hash\u0022: \u00220b56a35fea8ce0b7c79004682198e73c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002248d3df03c3488ca5d5992222530612bf1d71e3b1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12599254,"ip":"15.160.137.85","ts":"2026-07-16 22:32:32.000000","proto":"tcp","src_port":7952,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info\/%2eenv%2edist","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002259b558da015d01f2939764f8733c9dbe19cf209a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.182199083679177, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002263b6e07da1c40d6f4ce3571b4a4f171ae95e1f42\u0022, \u0022event_fingerprint\u0022: \u00220c0d178f72ac98ab1aa068cc2d414a7db9c13bf1\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222cabdb933cac5945e27a3c9f6bd7cf15\u0022, \u0022path_pattern_hash\u0022: \u002231e472d70f7d655171121b123169ef03\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b7404c5da7a574bd7215b3c422ea33c45175aa48\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12599255,"ip":"15.160.137.85","ts":"2026-07-16 22:32:32.000000","proto":"tcp","src_port":7962,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sql\/login%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002276492cdd4ca7da756b3e84beba8e5086c1d473f4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.203624695799311, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022efd1fa00679249f6736aab79d8513e89504f5586\u0022, \u0022event_fingerprint\u0022: \u002208e1d1d3756d2ff47c218592d3d7a22750d08a37\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229fe29f32ae3f7d422cf37ae839d56f48\u0022, \u0022path_pattern_hash\u0022: \u0022dbd52cceaf86f6df85e7584a176672f8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222e6c9e8383e75508f1999d69db8347123a1629e2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12599256,"ip":"15.160.137.85","ts":"2026-07-16 22:32:32.000000","proto":"tcp","src_port":7974,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/aws%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00227387bb51d5104b879d0e99dc9944d1ea1af5fb99\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.184424822624168, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002269d7830e7810db60c5ae2d51ad3948d388dfa0ea\u0022, \u0022event_fingerprint\u0022: \u0022de9324ff74c68c0b6359cb53031cdef7f99346f3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e22799824e7341541107e6e25a366867\u0022, \u0022path_pattern_hash\u0022: \u00223363573a2f1d6e8551aac742e2f1bbd7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d66e8b59e297a0e620a195d0fa0f5fa1d5754b09\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12599239,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7858,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/private\/ses%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022f47395e56d3d527db1e3f890f0c3e5ff743b1c96\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 381, \u0022payload_entropy\u0022: 5.1708301161239785, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ca458383e8a7260c196ccf1232a9114ba0dfc5fa\u0022, \u0022event_fingerprint\u0022: \u0022829cea7ff6553c87203d48b7a828ad65d2190914\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022bc4128d53c27442ac0c9437100ec26f4\u0022, \u0022path_pattern_hash\u0022: \u0022e3edf72b89e306a325c47fe5b53531f3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022579ab8629ffde3dfb329ef26ade09e1ce89cad70\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":381},{"id":12599240,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7860,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":32,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-admin\/network\/ms-plugins%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022d0604bd294cc12c0955a581beca19967e6c52875\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 397, \u0022payload_entropy\u0022: 5.2177707293630355, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ef43c2adfc33daf78d366d3c5710be037320fc07\u0022, \u0022event_fingerprint\u0022: \u00221b01296261010fb175acaa49380eb8dcbae3abb3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022615c82dfc6d53f4e3c2b8bcd0a359c37\u0022, \u0022path_pattern_hash\u0022: \u0022e122959fd1e06d1c49586e746fa1e004\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227e0c04a48244b6dfd16300ad7c83f57c704fe456\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":397},{"id":12599241,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7862,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/decode%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00229176492dea225c37afe64355a4573bac33b15403\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.173172749807165, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002269d7830e7810db60c5ae2d51ad3948d388dfa0ea\u0022, \u0022event_fingerprint\u0022: \u0022bdef1c779130169a77b036e89463e7ef5ef79a10\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fa256cb4a2051401dd45d5b17124e0c1\u0022, \u0022path_pattern_hash\u0022: \u002232feccaba1604e74f0afb6a05e1e09fe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a984f7b99b19f384ec57c018081616b86da9e3f5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12599242,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7872,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/tmp\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00228570f8553126c3d30f053cbaf09c38af8a38a09a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.196936620982564, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022935637fbfaeddca93db9d875f66fb3f52a6706ee\u0022, \u0022event_fingerprint\u0022: \u0022a916ed168a06cfa57afbc633c4c41b4b6f660dba\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222c2d9b2e00fe100d05847ba871300d9a\u0022, \u0022path_pattern_hash\u0022: \u0022018008c41ceedeb260bc2b30df63430d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f91716869e0b212779cdf36e6d920bf718974069\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12599243,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7880,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_cloudfront%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022b780fe5356382fdf7dadb1e9cfa6adc3341b7fad\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.2097035485216985, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u002202e12262d1f6350733395bc86820e8f1eed0417c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220c5a17f799e4e601be0c9e0f08c0466b\u0022, \u0022path_pattern_hash\u0022: \u0022c8c4be3a6a7f473bb92f01164b059b48\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022921fe89cf15c75931cbe9107044427ae405a83df\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12599244,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7882,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/secrets\/config%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002209d6a4c994c1f2cff7878cfe15a3080286fbe608\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.178972195913887, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022948a3f0f00679f59960a2c997754d4e6d5ec588c\u0022, \u0022event_fingerprint\u0022: \u0022d9bf2672a2d38854353a3626ac17a75bbeb75a13\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002236961cfcbbdd3645f5ec26ae33e6b2b3\u0022, \u0022path_pattern_hash\u0022: \u002285810599d11150068ef74d98ae0af279\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226cc0a37981d80774d136fb4d5e41d33f74ed29ae\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12599245,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7884,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/test_phpinfo5%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022f203492862c6fba6dff438691931b373b1815a97\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.205071321409659, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u002287081daf8a3ec4057efc8a029eece5916dc7e3b3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fcf1a047c57fee7bbe0ddaccdaa9a022\u0022, \u0022path_pattern_hash\u0022: \u0022a88015c2c876b7ff39d555606930e0ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002289dfb8996c3133eabe2373e49d4a85e9e0b95831\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12599246,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7888,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/sendgrid_config%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00222155bd174d1ed45ee2ef50cf65e7c826d5a33ee1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.203223077787153, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022a21b9bc2da83ea4fc6db90748c9abb07f4b43fb8\u0022, \u0022event_fingerprint\u0022: \u00222280437265206319207dcf593a5769a20416d3b9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229a87b5ebe1cb7ea7fbbfe6758342315c\u0022, \u0022path_pattern_hash\u0022: \u0022a4039cc7a913ca3c84f0aa59da2f6b35\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219e977bae0d34fdf25d8e27d214082c3feda4806\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12599247,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7894,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/static\/debug%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002262d03db252b7920658fe8de4c5e9c5acd4a1809d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.197905855102113, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022935637fbfaeddca93db9d875f66fb3f52a6706ee\u0022, \u0022event_fingerprint\u0022: \u00227b33407007ee0e633182a1befc4e528b8fd5e179\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227df645ffd42ab2a002da15e9d7cb5d00\u0022, \u0022path_pattern_hash\u0022: \u0022dd4374e6396725b4a93e496ab548a1f2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261a5b2710eb0b3d71cd442c04771766d14d28b65\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12599248,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7910,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/debug%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022d93981c8b7420d6138ccb6ef0557c8efcff682d3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.172099757868942, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022249c559799e66a3d0a148156e37b2027275cc9b1\u0022, \u0022event_fingerprint\u0022: \u0022eab0aa5601da3fed177e9b1e642b186b3caf97d3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002259d6cfe0d7260f734751256ed7a8e742\u0022, \u0022path_pattern_hash\u0022: \u0022cda7cc188909acc4e69e36a80544397a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022520f35e70333cc2cffd73098f81f217c04e64275\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12599249,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7916,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022541f35df5563d54455a41ef0d97f8cde41b7aff9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.253446825932138, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u002210a4f3da6571e5b8071f5f355aa9a23bc589795c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222d561d844724de56e8fa482af17bbcd0\u0022, \u0022path_pattern_hash\u0022: \u002203603d0d578626744a99e336209572c9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e9b827247d7782bea7e3737f706cdbdc9a21918b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12599250,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7920,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/backup\/db%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002225e87c690d67344e4c2c90367889c6f2c0981fc4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.195542078473768, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022bc65f9386e9fc2d9e0aecf0d482cc605a138bffa\u0022, \u0022event_fingerprint\u0022: \u0022d9eaa26dab7ece08e34d9b1e54f70762060d2fef\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022325f9cc2b6cdb9fc827f0735159f7e5c\u0022, \u0022path_pattern_hash\u0022: \u00229003ac5eed01bdea8382e25df338ceeb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022409bf4812504292a0a8123e4a980641fcf9ce871\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12599252,"ip":"15.160.137.85","ts":"2026-07-16 22:32:31.000000","proto":"tcp","src_port":7924,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/tools\/aws%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022651be48e9fdab6a7518117717db25429c13814f0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.174939353793734, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u002294be84613acae04bff8b76b7e423831d6addec8a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d1e0ab968eef72ecc1407132079f30c0\u0022, \u0022path_pattern_hash\u0022: \u0022c2d7238488913a3bf9ab8e03cfbee1e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022468f8d963f86a72d1f8fc7ad0d288ce4b82d1db1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12599226,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7754,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info4%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00225b799c4b6ebcc4b3a9438741142d022a47b5d659\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.181300754421366, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u0022e135f93bb97806db53fc4e14598c7eaa7157434c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fa60db07f520cc24a1c112ce549284c5\u0022, \u0022path_pattern_hash\u0022: \u0022aa6001943d9690d57e8a283353e2a677\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002229e959bbc0f6d9f4ec3722a6da14c128fb7b3809\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12599227,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7758,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/test\/main%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00222683a0217401eb0e58d5fe7eec10204f0e06c3a8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.1852413290350325, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022935637fbfaeddca93db9d875f66fb3f52a6706ee\u0022, \u0022event_fingerprint\u0022: \u00225874e6a098d1d853934ab3bfd9581a1073317c17\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022442f4ab7d235548bf2b9ae9e414d5c44\u0022, \u0022path_pattern_hash\u0022: \u002211679f661efb536d80c1931b06526b9d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002246e2e53d0fa43b4d5d8fa75939360c4ebeaade72\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12599228,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7764,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eenv%2eexample-hotfix","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022743fece80801d4ea4cab1adf80ab535faee6f034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.2163652233785305, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e29adaf97e56caf27f46ffbda990185733c74b7c\u0022, \u0022event_fingerprint\u0022: \u002277a8d75d52d47681d26af7ed26d39c428d4c7690\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c142f05c7f4a40ba74b108cc1c21f681\u0022, \u0022path_pattern_hash\u0022: \u0022e4a000b7b4be6ad319c134450cae8196\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226a256fea3371105aa89f70257c10f85ee25c297b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12599229,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7774,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/app\/elasticemail%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00223ef7c947081c1beb4061bca77ba7b50faefd2e06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.182877782206267, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u00227dc1114c35368cb391aef51518168be160ca353d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c27319da3734ee414dc556525971703b\u0022, \u0022path_pattern_hash\u0022: \u0022360aadd960970cd36ff7d3e483dc7910\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce79a4e4432603bd43f1af7e85b49845ce51bd2c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12599230,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7782,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/portal\/%2eenv%2eprod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022093ebda3dedfdb4a0cf459c6463c195139c940a9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.1746497009856975, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002263b6e07da1c40d6f4ce3571b4a4f171ae95e1f42\u0022, \u0022event_fingerprint\u0022: \u0022def6776c1259b7d942305f225b2ed1385e4359f7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a17f1fd1a255b0ea4f3729e5879ee3c0\u0022, \u0022path_pattern_hash\u0022: \u0022cdaa04f21ead530e229f84bd2ffd4513\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e649fc5900335e2fad9f83106dfbdadbf909744\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12599231,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7798,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/mail\/smtp_credentials%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022ecf190531f1d21f6ce40d24c8bad12751878839b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 396, \u0022payload_entropy\u0022: 5.216302503941773, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022a21b9bc2da83ea4fc6db90748c9abb07f4b43fb8\u0022, \u0022event_fingerprint\u0022: \u00229c1a0b29214eb5a40c55b09d394c9240af7dded7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002220d7a29f54107296b33aa65380173b96\u0022, \u0022path_pattern_hash\u0022: \u00229d651ca2ea14b371bc67173f4063211e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dfb0b88f62d68d20cfea726a127be16812af4e11\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":396},{"id":12599232,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7804,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db%2emongodump","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00223c63a8750bc7c2b0a13eb48396b0f7eec9aab1e2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.19016394628863, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u00223e3e8d5fac75eb14e793cd3a99f4826dda90e9b3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022bcbe581a4a9b8bdd675d1ccc73f0bca3\u0022, \u0022path_pattern_hash\u0022: \u0022fc4dbf1424f0b82f0d46ec2a174d9965\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ed7213fb680c3c3bc8292def160f31d5096e0a7c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12599233,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7806,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/application%2eproperties%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022477cda7c156ae739b0777b9d90df8fa17e6663d7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 395, \u0022payload_entropy\u0022: 5.164126784212553, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u0022bee688e8d402f95c19172bf04fc065cf3f4d4812\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002245b8c21c38791a7ffdf5d727eeda1e9a\u0022, \u0022path_pattern_hash\u0022: \u00223eaf164e6a8c4d1d5558c1b9873068ab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dadfb877fa619f45ecfed1c44ed0ca3434d5fb53\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":395},{"id":12599234,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7810,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022b50e237670b086158a8da4c50204316dd18d6d25\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.186689124588813, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u0022ed5e764c0d4fbfb8235ead651ae4dbe83e8e5e75\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00228f0a50e56d3837fe49c9133b3fa54b2f\u0022, \u0022path_pattern_hash\u0022: \u00228dc423889a8bf4ff9ee47a1f73198c94\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f1e1482ce7341872e89b68805317e2c91a02654a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12599235,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7816,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/terraform\/terraform%2etfstate%2elock%2einfo%2econf","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00226fbf3fc997393cd26212322e66f14a1fe80724c9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 414, \u0022payload_entropy\u0022: 5.209655575853667, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022837c549137578d9c94b174f00126dd4f13458af5\u0022, \u0022event_fingerprint\u0022: \u002266cad6d70189fbfa1e37396e4c1b129736c0df03\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220b6844154497f180bce89431adc47d4a\u0022, \u0022path_pattern_hash\u0022: \u002265f693b9dd982e63f572314c321f0714\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002234ef3629ff425abc28ae2f843050e5615693d19d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":414},{"id":12599236,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7828,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/keys\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022b8dd950a420302c535d9efec2409fc43710b349a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.222675030575659, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d5c86b582b3fbd4a78dab62babd4c431e0e65745\u0022, \u0022event_fingerprint\u0022: \u0022af24442d1443ea6e384c92c97380c914ccbe6567\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223bae321eee75450a7c55885347ce9786\u0022, \u0022path_pattern_hash\u0022: \u002271bb9e7055c0f5a6a3f2aa9af9f54af3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225f39bd5de9ba739ce0aeba694eb89890e628f7d1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12599237,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7840,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/config\/sample%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002269e910deab36501fd3dadb45398d2e093d905c9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.194150099369195, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00225f95c08069df8e84b26ed4302e01c57776efbf33\u0022, \u0022event_fingerprint\u0022: \u00221558c9fcf356dbf392947ba678c2fb679fc8f358\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220bb00ec44681f530bbb46353b72e5ab5\u0022, \u0022path_pattern_hash\u0022: \u0022da152312ca3e7ae29c060a1dc480166f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e15769b8b93e3a360edefdf0ecf6defd8f1cc4d1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12599238,"ip":"15.160.137.85","ts":"2026-07-16 22:32:30.000000","proto":"tcp","src_port":7854,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-content\/backup\/dbdump%2esql","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022dce844ddad552756948d90ddf939523f6ea20489\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 394, \u0022payload_entropy\u0022: 5.221814262889924, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c184ffec281a93f07c8ae01f3636297262ffc94b\u0022, \u0022event_fingerprint\u0022: \u002203543a5610253eb78d38dcfe092b02b0c0675d4b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c289003210ca9491714e113da842b577\u0022, \u0022path_pattern_hash\u0022: \u002246401f3dea5961de30c238b6950848a9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002224aeea566b9ab074d5daa259d8e5da9c97e62b88\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":394},{"id":12599212,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7620,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/custom\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002283345ee7b16d1d2aa90988b373c2a7cb2bbaed12\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.176757957631388, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002263b6e07da1c40d6f4ce3571b4a4f171ae95e1f42\u0022, \u0022event_fingerprint\u0022: \u00223ee99aa35b474eccbc3601bc7c0624ace6ef12c2\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b1ba769c058b384a4434b39443384529\u0022, \u0022path_pattern_hash\u0022: \u00224e59106525e243287c9376964c3f2170\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fb935145d5a13a3cf602daa10a2c53dad5fadc74\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12599213,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7624,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/new\/info%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00223be98612c14adf93fb1cfe89830f0d980f09dbab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.18137997037282, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u002266860c87e620f5cd2e030a9f9e2d4fe72ecb8650\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222332724844b7192360b6479328414b63\u0022, \u0022path_pattern_hash\u0022: \u0022a7a9f5c2684b775940252b03aea345bb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225c6790dbbe626828cb1840130537e1e98a0173df\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12599214,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7636,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/publics\/%2egit\/config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022dffdd03c5a3f6000d7374bbeda953224c20b9853\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.190442208343631, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022012c87daa0ef4ebe0a72f5944c93b82c685b2647\u0022, \u0022event_fingerprint\u0022: \u0022ca51cebc3f2c69d9ed1da2989232c687f1bcf85e\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227cde4f0fddc4ca0eae4ccd2c067bdbe5\u0022, \u0022path_pattern_hash\u0022: \u0022c022a7a77ca5d3c8e53e008c45692091\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022efce61ec574a770079b4bdb722e6e523ff5895f0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12599215,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7638,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2essh\/public%2ecrt%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00224161c777803c6e2a426033a05cdb91ccfb36ebb7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.210900843337846, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f9d90e718fe360f2e9d357938015f0601724815d\u0022, \u0022event_fingerprint\u0022: \u00229b9056eb5531c293fbb7516442518464ce323dad\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225b4ae2aa3454e3e65c284271d411e0fd\u0022, \u0022path_pattern_hash\u0022: \u0022531a9de251d1f71df3608b911075179f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022857f34dbfa52878c9f18d23b5fec2e389d26ea29\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12599216,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7650,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/server\/laravel\/docker-compose%2eglobal%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00227f07050fb319bb1f0c743200b0485d27a42e3cdd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 408, \u0022payload_entropy\u0022: 5.234622751919788, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u00226799a6de4b80f10b654a41afdbc3c9d12e6f7a1a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002277d97f730f04cd3c6e413c1ac08be2c6\u0022, \u0022path_pattern_hash\u0022: \u0022d8daca7d08ee459742540f7e5191601e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cd186669fa93521c82a866e6401b574816fd1541\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":408},{"id":12599217,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7658,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/slack_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00224f67881f111a3db188813e19a5fedf72fc20a61a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.211923441026756, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u00220ede3f72d4ddc80d16485afb4d1310d759480250\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b54610dfa56357527c4b027077d6c8ad\u0022, \u0022path_pattern_hash\u0022: \u0022997b6c777514621d5fc0db4f7df9b95e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002255c5a602fb4f1eee2b005f0742280108d357d90d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12599218,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7660,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/sql\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022f713e687d10b1ef89cde41580dd4b64d36c1112d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.180366753863114, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f5a51c97e39f8925d19f28ec62d8033ca54099fb\u0022, \u0022event_fingerprint\u0022: \u0022f5599aa6d81228dbc8b1093fa20b065c73e33842\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225eefe7a3fc0ee2a478e566cc674fa6b8\u0022, \u0022path_pattern_hash\u0022: \u0022f695599c426f3fa01dfc982b4508daaa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222a7dace51d4e4251060f8ff639f1760ce3c0af0e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12599219,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7676,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/mailgun\/sendgrid_api_key%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00222be079332c04ba6dfd68b21873fe837316b2d866\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 401, \u0022payload_entropy\u0022: 5.240633345281996, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00229582f338f900f14766fec936e5c15b21483455dd\u0022, \u0022event_fingerprint\u0022: \u00229b4997fc37452f930f22cd8d2e82e951349da09e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224cc58df7b16d995bba9ec01d7c72c72f\u0022, \u0022path_pattern_hash\u0022: \u0022d1f7a6c60f176de79efd6cf86e101bb6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b5cb9ef95951a26fa86db0fd90d6c6e4e303b7b4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":401},{"id":12599220,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7692,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/secrets\/settings%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002294a893c5793b7963caf14b2735bdb6517354bc00\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.167720763171197, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002282ea4135f5920bf2026df961ab35faaa51426656\u0022, \u0022event_fingerprint\u0022: \u002289c7efab3f6b80e6f20aef4c85a2085aeb95ad8b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f661f2d5dfcac86c6c68fe7a2d4fa04e\u0022, \u0022path_pattern_hash\u0022: \u00227f8aef03e9383566f2641607540d417b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa521c3511f5e6bbd6d6345151ce7efbfeabc2ca\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12599221,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7698,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/armnn\/env%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00223018cb95243bc16776e28bb51ebdab0add14eda7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.172310600909365, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u00220a2a39b2697613bb996badd665a64af6c89dfc22\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227d15353fca4c34e0b189bea0b1e2c346\u0022, \u0022path_pattern_hash\u0022: \u0022dd5aea81f1e2902d0553a9e84ef93dc3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cca2cbc62b7c36b2cdeac6e8c38e9bf4f12f91cc\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12599222,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7714,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sample%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002250aaaa9aa133d35fa3aa95c51c475620f1e9001c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.205485796806687, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022efd1fa00679249f6736aab79d8513e89504f5586\u0022, \u0022event_fingerprint\u0022: \u00224461e495171c6d52c16d2f953088052129928444\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022583f46a631052f1bc323df65f2c81d39\u0022, \u0022path_pattern_hash\u0022: \u00228d06070e9c9922e376f5a87aad4d0fab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dc53c06eaad16b0755eb928f9c3e1dcca200bb52\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12599223,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7730,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022f0d8eecf3e972fd0e3f7a8fce92e2d8d58bd987f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 409, \u0022payload_entropy\u0022: 5.28442689437791, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d92916242c2fe0c5d86c20cff7aec8ecc9b64195\u0022, \u0022event_fingerprint\u0022: \u00225c598b9151da21d350b46a697fd01d6c6110597d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a1fe6f04d74780bf2248186374a66d3e\u0022, \u0022path_pattern_hash\u0022: \u0022570e00ca8fa297c6c2ecbda5b086280c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002224a452dc19c9dd2d73b0bf7a59d5bfd7b1daa81f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":409},{"id":12599224,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7736,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/settings%2epy%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022e8aa58d373021c43cb2633d417ebd462bc4d5a6d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.171365091589829, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e0018aa219889905a78f50b87a0bea861cc082\u0022, \u0022event_fingerprint\u0022: \u0022cdad8e1231108a35e9566c1d5e8d176c07c8301d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ddc9d36f6b87f7920809ef0fa1f19fcc\u0022, \u0022path_pattern_hash\u0022: \u002211582cbdb6718d89141ec3d325abff39\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d57d098afd8a5f3001ed13a2c3356b6b117e694e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12599225,"ip":"15.160.137.85","ts":"2026-07-16 22:32:29.000000","proto":"tcp","src_port":7742,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/public\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00220384df45554daec98d08f86ba73f2432f210c731\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.216917926163899, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022aea8212568276301767818e4be1c7e37f4b5e014\u0022, \u0022event_fingerprint\u0022: \u00225456f403f0110c4b23693feb9e65640e25d6afb2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b051446356d534c9325a55442ef75420\u0022, \u0022path_pattern_hash\u0022: \u0022c66eae166966f1c8bc6680c13b79086c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d517c10d4aa39a988f502b3a0d94a90a49ac9871\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12599199,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7492,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backend\/phpinfo%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u00227a55745e8b12b180a3aacac8cac6645f60294342\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.211720737118484, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221a65f8e9edb0e76fd4d3261fad739fed76607ee1\u0022, \u0022event_fingerprint\u0022: \u0022a43f754ca6e794cac3074a278ce38bc727c348fa\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002209bf49141a8f21591cca6a354c53df75\u0022, \u0022path_pattern_hash\u0022: \u002258c4c498db915d13692a6e962f174c12\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c75136a04ce3139e425a0007520b1f3bdaf201ad\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12599200,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7502,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backup%2eyaml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022ba4a41f51c1f3792ca8428cfb3c83cc2e8a2632f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.200266742956259, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002269bb33b801a7f132f0653a681cb68cdcb1223b46\u0022, \u0022event_fingerprint\u0022: \u0022074db497e816111443139456e041c034e410e633\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d7388d772c52f14f082dc5e79f6f4ab7\u0022, \u0022path_pattern_hash\u0022: \u0022a943e05b882b279cef2f6f021456e7cd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c9bb6a280127ff84a67801a0a5b2303731629db4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2eyaml\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2eyaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12599201,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7510,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/data\/*","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022dea9678fd4238325011b7306db4cac9f89f581eb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 374, \u0022payload_entropy\u0022: 5.153990349093432, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022a21b9bc2da83ea4fc6db90748c9abb07f4b43fb8\u0022, \u0022event_fingerprint\u0022: \u002231a4b47d0a36f763774f8b281bfb9d03a5151e1a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220bfd15d1efad6c137e6cd535312e5da2\u0022, \u0022path_pattern_hash\u0022: \u00221dd281a6b15ed2db90e8c09fc51672e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/data\/*\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/data\/*\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b217c4fc0eba79d5f4217168504f6f99206ccdb1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/data\/*\u0022, \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/data\/*\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/data\/*\u0022, \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/data\/*\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":374},{"id":12599202,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7520,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/public\/db_dump%2esql","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022147e11916e2360ce1fefc2be2ed283a704a41198\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.223995760534373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d96947f0ba5ff093eb9bbc8d80ed6551ec9b16ef\u0022, \u0022event_fingerprint\u0022: \u00220c2cc651d639b4c3c7d8bf262691af2e34385d30\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022be25c265d787299348458ebafcf0a528\u0022, \u0022path_pattern_hash\u0022: \u002292b556d879c0ffd394b49234a7965edb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/public\/db_dump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/public\/db_dump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229f95072259fce79ca3f005d0d4df230bff6a2cd4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/public\/db_dump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/public\/db_dump%2esql\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/public\/db_dump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/public\/db_dump%2esql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/public\/db_dump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12599203,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7526,"dst_port":7445,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950516:leak-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/package%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u002258e29e96238c929965b69e5724b946e923fd5349\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.173724798075603, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002221c7d3081f22af1a12b53e067b9d9dbbcfe77df8\u0022, \u0022event_fingerprint\u0022: \u0022abdd54df90654aaacf2226f84f25e2149a1d79b5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002278b4177cfd58fb669db69c5ebb115633\u0022, \u0022path_pattern_hash\u0022: \u0022a082c18a36268cde2c06f30e82f80ef2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/package%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950516:leak-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/package%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/package%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950516:leak-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/package%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002268fece1228c0b14ed2f5c6f85bca51cf30a3be06\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/package%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/package%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/package%2ejson\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/package%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/package%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/package%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/package%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950516:leak-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_package\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950516:leak-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_package\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12599204,"ip":"15.160.137.85","ts":"2026-07-16 22:32:28.000000","proto":"tcp","src_port":7528,"dst_port":7445,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/news-app\/frontend\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022955428a14b9cd32100ef8f7d191df808c958caf0\u0022, \u0022http_target_hash\u0022: \u0022a1ee74ed4f5cbbbb2314d7946ff753422c481b9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.181790254062481, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7445, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002263b6e07da1c40d6f4ce3571b4a4f171ae95e1f42\u0022, \u0022event_fingerprint\u0022: \u0022c89f353c692e35b329728cba6c7d160d236ffed7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b7d0e5441834496454a9d3a91347beeb\u0022, \u0022path_pattern_hash\u0022: \u0022c6504031f3d04dadfc28bcbaf3b80654\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d12a320778223cccdaa18e76ddd5eff4c551663b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/news-app\/frontend\/%2eenv\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7445, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7445, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7445 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/news-app\/frontend\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7445\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227445 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7445","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388}],"total_events":6000}