{"ip":"15.160.33.6","exported_at":"2026-07-26T08:33:31+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":82,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1499","top_mitre_count":1854,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30,"risk_score":82},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499"],"tags_summary":["MITRE-T1499"],"attack_vector":"http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold","protocol_details":{"http_method":"GET","http_path":"\/aws%2ephp%2eold","request_line":"GET \/aws%2ephp%2eold HTTP\/1.1","http_user_agent":"curl\/8.7.1","port":7022,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/aws%2ephp%2eold \u00b7 UA curl\/8.7.1 \u00b7 HTTP:7022","evidence_snippet":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag","target_port_label":"7022 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 5 tag(s) WAF","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","classification_reason_label_fr":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF","payload_preview":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag"},"events":[{"id":12572090,"ip":"15.160.33.6","ts":"2026-07-16 21:43:17.000000","proto":"tcp","src_port":53588,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_nodes\/http","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022ff6b945c65ec0157356b158dad63a07259b32811\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.138372964776699, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022f50af6971a8c58cafa2116b2770ef58814a264e3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ES nodes API\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002215f15388bbd339fb837ca774a69b2ff5\u0022, \u0022path_pattern_hash\u0022: \u00220b56a35fea8ce0b7c79004682198e73c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d1f848e44843fbfe5e751fe0f1cc88e8f601587f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12572092,"ip":"15.160.33.6","ts":"2026-07-16 21:43:17.000000","proto":"tcp","src_port":53604,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info\/%2eenv%2edist","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002259b558da015d01f2939764f8733c9dbe19cf209a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.150566824829022, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022590bd59ea4b3ffc0801dd50a8db3e05521e43d7e\u0022, \u0022event_fingerprint\u0022: \u0022a1a25ab45e41279d328b7304abcb2a4b57c127ec\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227f66237a6296cd74534c595d6c950a7f\u0022, \u0022path_pattern_hash\u0022: \u002231e472d70f7d655171121b123169ef03\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bc16f410783af5b464aefda31d6e404e8a463c2f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12572094,"ip":"15.160.33.6","ts":"2026-07-16 21:43:17.000000","proto":"tcp","src_port":53616,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sql\/login%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002276492cdd4ca7da756b3e84beba8e5086c1d473f4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.172919844733428, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221c4b3fa62e104514d9494995da33f4427ab8cf7c\u0022, \u0022event_fingerprint\u0022: \u0022af6a028353a2e2caed65cf445b85f295d28d8e3e\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002271d87085e9063ec5fa506da5314e4a1d\u0022, \u0022path_pattern_hash\u0022: \u0022dbd52cceaf86f6df85e7584a176672f8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221ede86773480f96129810d34cc68a5705479b3e8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12572096,"ip":"15.160.33.6","ts":"2026-07-16 21:43:17.000000","proto":"tcp","src_port":53622,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/aws%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00227387bb51d5104b879d0e99dc9944d1ea1af5fb99\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.152542176500793, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224eba704b072f1c864e6e3389f6103d1b66579482\u0022, \u0022event_fingerprint\u0022: \u0022059a9e281a796175073d246f58cf06b3ab92a482\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002273bbf21c6c9bf114e2ce37a9104fc6b8\u0022, \u0022path_pattern_hash\u0022: \u00223363573a2f1d6e8551aac742e2f1bbd7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dc56416e448bd1d1c8c743aef8f40a630fa76295\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12572064,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53430,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/private\/ses%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022f47395e56d3d527db1e3f890f0c3e5ff743b1c96\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 381, \u0022payload_entropy\u0022: 5.139722314256706, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227e53b979575cd228c7991b7c9c12ce2c33bd217e\u0022, \u0022event_fingerprint\u0022: \u0022ecef751b5a1e19e42033ac5e8f0e4c71b1bbbfb9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223c25f06b16f0dba80fc37abb536746a4\u0022, \u0022path_pattern_hash\u0022: \u0022e3edf72b89e306a325c47fe5b53531f3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223851cd1a0162ab3aa6cf3890138855cc886c874d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":381},{"id":12572066,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53446,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":32,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-admin\/network\/ms-plugins%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022d0604bd294cc12c0955a581beca19967e6c52875\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 397, \u0022payload_entropy\u0022: 5.18791664243248, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00229def3fa62b224bf83523f63d6142a34307b8048e\u0022, \u0022event_fingerprint\u0022: \u0022322b03c7feeb618f7c47464ca46f8e4bd74f7486\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222770c77631ac9db590ee96235aebf6cd\u0022, \u0022path_pattern_hash\u0022: \u0022e122959fd1e06d1c49586e746fa1e004\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002286919d4a60f1bef369e9673672fe10efd24da5fd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":397},{"id":12572068,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53460,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/decode%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00229176492dea225c37afe64355a4573bac33b15403\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.14154049095701, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224eba704b072f1c864e6e3389f6103d1b66579482\u0022, \u0022event_fingerprint\u0022: \u0022ffb21590d755bfed168f0ffa53a16167ff6b1c90\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00221c27559b1488db85764c76d96be9eb84\u0022, \u0022path_pattern_hash\u0022: \u002232feccaba1604e74f0afb6a05e1e09fe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022653f94de781fd1660290a18eed0ab332103d4e18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12572070,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53472,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/tmp\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00228570f8553126c3d30f053cbaf09c38af8a38a09a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.166468568253951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d9d4a86ce8667da8b74b9ec4d0617774e126cdc7\u0022, \u0022event_fingerprint\u0022: \u00226de036b7c940298da344e10875853e8c91f9d9e9\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022718bfd10b929e6a66527db1249716838\u0022, \u0022path_pattern_hash\u0022: \u0022018008c41ceedeb260bc2b30df63430d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fad26e4a42fbc181d4fa98f09bec8f8a19d51c2a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12572072,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53474,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_cloudfront%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022b780fe5356382fdf7dadb1e9cfa6adc3341b7fad\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.179156969883991, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022818d0dfc65d8d9f48e3a9f110d18ef6705113eaa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022238b93399c8a41432cc9a15ab9245649\u0022, \u0022path_pattern_hash\u0022: \u0022c8c4be3a6a7f473bb92f01164b059b48\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022537854da83144a85a53806e28a316af9c7d551b8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12572074,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53488,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/secrets\/config%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002209d6a4c994c1f2cff7878cfe15a3080286fbe608\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.148425617276179, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221c710f669e7ff98ac77d98025003188fe9d13197\u0022, \u0022event_fingerprint\u0022: \u0022e39b2c83a171c9d1e58c60690a40e7431d5ffdbb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022cd5da6a7dc3c5f5d07abcdbc631e2205\u0022, \u0022path_pattern_hash\u0022: \u002285810599d11150068ef74d98ae0af279\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229add692aabafa8518229a320ab458a43098ff7e2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12572076,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53504,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/test_phpinfo5%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022f203492862c6fba6dff438691931b373b1815a97\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.176096948017317, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022bf130f20d6451523b6019395cc1fe446ad4135e5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a7c91c17f94301db4a7d10d6064adc5a\u0022, \u0022path_pattern_hash\u0022: \u0022a88015c2c876b7ff39d555606930e0ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226f5d58fc7c3ded63f8ebbe92e15025e7e0e1e51a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12572078,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53520,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/sendgrid_config%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00222155bd174d1ed45ee2ef50cf65e7c826d5a33ee1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.172833148270664, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223ea53a6f52f3d418bec2432daa9ec62bbf21177b\u0022, \u0022event_fingerprint\u0022: \u0022ff7b0808125aed4009cc23e06e05a49e5c6d600e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002267a7e5d01bdba4b821f8f4fc6ed3c079\u0022, \u0022path_pattern_hash\u0022: \u0022a4039cc7a913ca3c84f0aa59da2f6b35\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d2788e544dfbaeb57bfe606e748dc3febb0bf51f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12572080,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53532,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/static\/debug%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002262d03db252b7920658fe8de4c5e9c5acd4a1809d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.167359276464405, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d9d4a86ce8667da8b74b9ec4d0617774e126cdc7\u0022, \u0022event_fingerprint\u0022: \u00225ce3a0d4b614b169bf25d0b60b371a4e781c9b6b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dd8e9a54d604a564487f9d13b8946f00\u0022, \u0022path_pattern_hash\u0022: \u0022dd4374e6396725b4a93e496ab548a1f2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022184bfd3a1b362366f0d577a07a353b6522c9a032\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12572082,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53548,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/debug%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022d93981c8b7420d6138ccb6ef0557c8efcff682d3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.14082779873588, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220e1120ec7c6db06e1b4bb0eac3b486f52959b07f\u0022, \u0022event_fingerprint\u0022: \u0022604fc7e7aab935d3e5e36d43464f46f9af77a17b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022db311b1ffb7b592dc14f3fc0817a068f\u0022, \u0022path_pattern_hash\u0022: \u0022cda7cc188909acc4e69e36a80544397a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e6d03cb737e5261a827c5be32f578e07b06842a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12572084,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53564,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022541f35df5563d54455a41ef0d97f8cde41b7aff9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.222436565208068, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022bfa886fd174ed5d8de1c5bc0baedeeafe921887a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dee06919d61b5ad10980279b9171b35f\u0022, \u0022path_pattern_hash\u0022: \u002203603d0d578626744a99e336209572c9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ee185bcf9b51e6fbefcf11a6584d7168661cc02\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12572086,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53580,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/backup\/db%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002225e87c690d67344e4c2c90367889c6f2c0981fc4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.164677306308583, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022af8270d6ca1906030b7c14a4ab78f46a750f8bd5\u0022, \u0022event_fingerprint\u0022: \u0022f664075c179917af1a716e7ca01e0578ea56e617\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ad05b249fdbf17ca77f82ea5c2da6735\u0022, \u0022path_pattern_hash\u0022: \u00229003ac5eed01bdea8382e25df338ceeb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229e79efba483b84fe40488f2d853bb17a8bd75288\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12572088,"ip":"15.160.33.6","ts":"2026-07-16 21:43:16.000000","proto":"tcp","src_port":53584,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/tools\/aws%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022651be48e9fdab6a7518117717db25429c13814f0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.143667394660672, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022741ba154c8b1340096950489ae100712e79e4e6b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022238386a8f646daa03d2635d48df325ba\u0022, \u0022path_pattern_hash\u0022: \u0022c2d7238488913a3bf9ab8e03cfbee1e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e930e6a7a23cf4a2fdbdb15efe98dc2679859285\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12572036,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53306,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/public\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00220384df45554daec98d08f86ba73f2432f210c731\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.186292415798445, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002298222c888ebca05334069a0636324ea59c3a9c54\u0022, \u0022event_fingerprint\u0022: \u0022556b468b85156ab057df63fe1e2af634982ec8e4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00226704aab20708c7a01df0476ba3357606\u0022, \u0022path_pattern_hash\u0022: \u0022c66eae166966f1c8bc6680c13b79086c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229c873a821614c8a617ce679e777ce4a81c2ca613\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12572038,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53312,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info4%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00225b799c4b6ebcc4b3a9438741142d022a47b5d659\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.157041594396653, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022d04db07ee29c84cf69b43e56018f74482d9b7ff2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c34d4b3fe718f23e822fd45481807849\u0022, \u0022path_pattern_hash\u0022: \u0022aa6001943d9690d57e8a283353e2a677\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d29d44a722ec773fa0cea6ae29a627633a44f6aa\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12572040,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53322,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/test\/main%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00222683a0217401eb0e58d5fe7eec10204f0e06c3a8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.154456725109238, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d9d4a86ce8667da8b74b9ec4d0617774e126cdc7\u0022, \u0022event_fingerprint\u0022: \u00221c0ff1239c6707eab92491a8bdcfde6b77200b63\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223fc88a01adfaec3d0ddce3b842a36e86\u0022, \u0022path_pattern_hash\u0022: \u002211679f661efb536d80c1931b06526b9d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002264c543dc0e76cabdbd0ba1c401f6f3e3680e8ac2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12572042,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53336,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eenv%2eexample-hotfix","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022743fece80801d4ea4cab1adf80ab535faee6f034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.185141650043234, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002284036ba54da4cd5871094fa1b15721f41f138c5a\u0022, \u0022event_fingerprint\u0022: \u0022d5278b51583af36f77f362f4c383cb2d5343af4b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022031e73e560b224149f631064684a6b2d\u0022, \u0022path_pattern_hash\u0022: \u0022e4a000b7b4be6ad319c134450cae8196\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227ab56157c57164c2718a33151455b189d83fe70b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12572044,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53352,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/app\/elasticemail%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00223ef7c947081c1beb4061bca77ba7b50faefd2e06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.1521729311403845, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022e6ac902856298dc9306f8769721723a1c45b502b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225871d038414c3f9d86bd093817ad2c0c\u0022, \u0022path_pattern_hash\u0022: \u0022360aadd960970cd36ff7d3e483dc7910\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226694168e2e7c2ab0a8ccc20e13cbf88d109336d3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12572046,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53364,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/portal\/%2eenv%2eprod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022093ebda3dedfdb4a0cf459c6463c195139c940a9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.143182193483721, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022590bd59ea4b3ffc0801dd50a8db3e05521e43d7e\u0022, \u0022event_fingerprint\u0022: \u00220a6b49477f0ea4b400aff1c062725b6bdf95b5fe\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022456f35b839c8d0149878c5c5f92663ec\u0022, \u0022path_pattern_hash\u0022: \u0022cdaa04f21ead530e229f84bd2ffd4513\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222cbbbfd6e25cbb9b6c59f6b8228090cd3ae872b1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12572048,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53370,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/mail\/smtp_credentials%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022ecf190531f1d21f6ce40d24c8bad12751878839b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 396, \u0022payload_entropy\u0022: 5.186373027902807, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223ea53a6f52f3d418bec2432daa9ec62bbf21177b\u0022, \u0022event_fingerprint\u0022: \u00224aa2bf0875922acf13660610664df558bc6f803d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ba2f3bedb9cf5ed69897fe511d65db35\u0022, \u0022path_pattern_hash\u0022: \u00229d651ca2ea14b371bc67173f4063211e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a516a042bfcf1b8b9ebc246ceb2cf097eb34e878\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":396},{"id":12572050,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53378,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db%2emongodump","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00223c63a8750bc7c2b0a13eb48396b0f7eec9aab1e2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.158809257104951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022c2109d6cee09c59810a926f344888f6861eeaefd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225ed821cf1f7909718383d553f1a437e4\u0022, \u0022path_pattern_hash\u0022: \u0022fc4dbf1424f0b82f0d46ec2a174d9965\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002268c8f69f2dfd10c3c0c9d99cfa76b31381ae452a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12572052,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53388,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/application%2eproperties%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022477cda7c156ae739b0777b9d90df8fa17e6663d7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 395, \u0022payload_entropy\u0022: 5.133535587046074, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u00224236595ccf4ba342816d82c0642268be16d68c21\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223f9469835f5a4e4b5a9c768f6f2095bd\u0022, \u0022path_pattern_hash\u0022: \u00223eaf164e6a8c4d1d5558c1b9873068ab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022246a172d01611cf621b851c5420d7eae38a781c1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":395},{"id":12572054,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53400,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022b50e237670b086158a8da4c50204316dd18d6d25\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.155251266468309, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u002205ea2e232fb86bcbf5336bac09bde56827796a57\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e05b9735f779bc7b8853c27417fad6fb\u0022, \u0022path_pattern_hash\u0022: \u00228dc423889a8bf4ff9ee47a1f73198c94\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022500275edda42c2bcde200d91509fc3f088b7748e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12572056,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53406,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/terraform\/terraform%2etfstate%2elock%2einfo%2econf","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00226fbf3fc997393cd26212322e66f14a1fe80724c9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 414, \u0022payload_entropy\u0022: 5.179469259255115, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022727423ae1d4ab5e0de150013b3a5aa7ca672ce25\u0022, \u0022event_fingerprint\u0022: \u00223c30d8ba205b4e9141d9a6d71214d4cdc45d5120\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002224849bc65c3e691f6e44f6b40bd43fcf\u0022, \u0022path_pattern_hash\u0022: \u002265f693b9dd982e63f572314c321f0714\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022db26c6b6f9b054cfacf65eea16bfd40c5199f20f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":414},{"id":12572058,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53408,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/keys\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022b8dd950a420302c535d9efec2409fc43710b349a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.192128451937951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e4cc3bb6c53998552b8e022d80594a857143c6fe\u0022, \u0022event_fingerprint\u0022: \u0022fb7a94eac5753a61d7706a30437ee40285d6601c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002261f3c98025ad2a812aa0a627ee5d9a21\u0022, \u0022path_pattern_hash\u0022: \u002271bb9e7055c0f5a6a3f2aa9af9f54af3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022af18f63983f671a6d7ae970c1617e6c5ea38d49f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12572060,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53422,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/config\/sample%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002269e910deab36501fd3dadb45398d2e093d905c9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.163524589003741, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022758ed1cfd7b452df2bdb76a9c4466d84922962e0\u0022, \u0022event_fingerprint\u0022: \u002235eaa6f76013a8455aa82bef6120f302450c8982\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022bbdec579a36e47a99271e2dea7a4067f\u0022, \u0022path_pattern_hash\u0022: \u0022da152312ca3e7ae29c060a1dc480166f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022df61a569d8ae60b2ff6f986676b9e90d9d1e206c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12572062,"ip":"15.160.33.6","ts":"2026-07-16 21:43:15.000000","proto":"tcp","src_port":53426,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-content\/backup\/dbdump%2esql","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022dce844ddad552756948d90ddf939523f6ea20489\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 394, \u0022payload_entropy\u0022: 5.191732860576648, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022cb6a20f141e9b1e99138469b6f76bff19425f8a3\u0022, \u0022event_fingerprint\u0022: \u0022f9a015960e88c2f158f323e6f685753ea509686c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002275a273efc1bc79b95f3557a3e218503f\u0022, \u0022path_pattern_hash\u0022: \u002246401f3dea5961de30c238b6950848a9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227b42a8ea3d7f2af0d46bf32f91c8bc1605aff1a7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":394},{"id":12572008,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53178,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/payment-app\/api\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00225a2b53ab33b90300214cb62365a512ab49f441a6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.160616113129775, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022590bd59ea4b3ffc0801dd50a8db3e05521e43d7e\u0022, \u0022event_fingerprint\u0022: \u0022517b52f167eaecaded188f44cd51d1a47d4a68fa\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220c3c5bc7731188d7a9b87edd9e14ccc4\u0022, \u0022path_pattern_hash\u0022: \u00225dd6ccc5ca99af94dc94d2ea0f2b77a5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c623ea62028f3c10eddaa3fd9172b08a1b9d6c8d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12572010,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53188,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/custom\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002283345ee7b16d1d2aa90988b373c2a7cb2bbaed12\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.145320099510883, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022590bd59ea4b3ffc0801dd50a8db3e05521e43d7e\u0022, \u0022event_fingerprint\u0022: \u002287a19fd23187975b1aeee24bc31d64e215e958a6\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e5f1fc32e4d094889435d071d86abe7b\u0022, \u0022path_pattern_hash\u0022: \u00224e59106525e243287c9376964c3f2170\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ff35020f415e1bb0b560ecb91865dd47b50dd9c5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12572012,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53198,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/new\/info%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00223be98612c14adf93fb1cfe89830f0d980f09dbab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.150025281189142, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u00227bccd85328bd122ac0ac7f7d82d9f57cfaaf8832\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b2e2ae9ee8f8c06b8768b29a3e4cf717\u0022, \u0022path_pattern_hash\u0022: \u0022a7a9f5c2684b775940252b03aea345bb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002284ac91bf707ba4bf278c6a1ab5c6ab8daffeb5e4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12572014,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53200,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/publics\/%2egit\/config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022dffdd03c5a3f6000d7374bbeda953224c20b9853\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.159657604417837, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ea79c5ad3a40382512731889a924c34f7e7cba13\u0022, \u0022event_fingerprint\u0022: \u00221965946aa207b048ee960c7b663093d9d9259860\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022eb0951c9ad91a95e92aee2ff4ca611c2\u0022, \u0022path_pattern_hash\u0022: \u0022c022a7a77ca5d3c8e53e008c45692091\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002221f180b2e1e1d3242e618ff669907acaf0f82e10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12572016,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53204,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2essh\/public%2ecrt%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00224161c777803c6e2a426033a05cdb91ccfb36ebb7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.17928709891908, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002282fbf6b5d30447cc9278aa8e18e94b9673a5715a\u0022, \u0022event_fingerprint\u0022: \u00227a693576b0f59b137aea4b65749e79463c23533c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227f1552ebe06521b7d52d6a832be4f4d1\u0022, \u0022path_pattern_hash\u0022: \u0022531a9de251d1f71df3608b911075179f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e8b610ae15993a65cb99576decdc38a2e114185a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12572018,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53214,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/server\/laravel\/docker-compose%2eglobal%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00227f07050fb319bb1f0c743200b0485d27a42e3cdd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 408, \u0022payload_entropy\u0022: 5.205006274270867, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022fa67d6359679a7a3158b9dec2316ac422c0f7711\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022bd4bbae72e8ec490f429ef48ea919003\u0022, \u0022path_pattern_hash\u0022: \u0022d8daca7d08ee459742540f7e5191601e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224004c43e878c94392e024e5c17b6b2c2a4cf13a0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":408},{"id":12572020,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53220,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/slack_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00224f67881f111a3db188813e19a5fedf72fc20a61a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.180978081989078, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u00229acfba52ef92e10e53e65c6c741328af7d7834c0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002224152a350a5e4014546ff32e987e4e00\u0022, \u0022path_pattern_hash\u0022: \u0022997b6c777514621d5fc0db4f7df9b95e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220edeb8da1004e5a3a4d789da1b748e21ee63cbb8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12572022,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53228,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/sql\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022f713e687d10b1ef89cde41580dd4b64d36c1112d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.149820175225406, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f97b65ab19fb62eb5403a9e6cc57bb6e9f2f247f\u0022, \u0022event_fingerprint\u0022: \u00220460d21580b2e64c72aa1874e156e79dbad07f44\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f45a15e07483ebe504d74f7a00f60941\u0022, \u0022path_pattern_hash\u0022: \u0022f695599c426f3fa01dfc982b4508daaa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b39720915047d80fa0279e6c75ae380596334a37\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12572024,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53230,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/mailgun\/sendgrid_api_key%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00222be079332c04ba6dfd68b21873fe837316b2d866\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 401, \u0022payload_entropy\u0022: 5.2110770547298, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022256c105e86fafcbfd17cf96557cd44460b2864e0\u0022, \u0022event_fingerprint\u0022: \u0022d1fd422c9d0644e47ba983164b13a088951aefaa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002266fc83ef5003cc43baef66e9e0e9bfe7\u0022, \u0022path_pattern_hash\u0022: \u0022d1f7a6c60f176de79efd6cf86e101bb6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224875e1cc8d1ead069485ba9be257279e93ba3cab\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":401},{"id":12572026,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53244,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/secrets\/settings%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002294a893c5793b7963caf14b2735bdb6517354bc00\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.137330833654709, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00225c861b5f76d91eeded01051f17c524eb1c14fb78\u0022, \u0022event_fingerprint\u0022: \u002216ecf183b2bd1e75d802b09d68d37122d22a8c16\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e580d82db3a7c02b0420bae8f520bb95\u0022, \u0022path_pattern_hash\u0022: \u00227f8aef03e9383566f2641607540d417b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224c420ddb5b9bddc170054a9868c7afa1c4788d8e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12572028,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53260,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/armnn\/env%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00223018cb95243bc16776e28bb51ebdab0add14eda7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.141038641776303, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022b38450eed8a5f9f07fec4f80d678ff52250ae4fb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002220f0435e0e2e0f78537b6d56ef51b53d\u0022, \u0022path_pattern_hash\u0022: \u0022dd5aea81f1e2902d0553a9e84ef93dc3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022065ff2f8e95b4a2d7bac336f9a894db35a4f27be\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12572030,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53268,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sample%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u002250aaaa9aa133d35fa3aa95c51c475620f1e9001c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.174540437769009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221c4b3fa62e104514d9494995da33f4427ab8cf7c\u0022, \u0022event_fingerprint\u0022: \u0022b4f19743ce20feed08627bcff547a812d8bc2fd0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022912fc30b214a79a58720b614f57634a4\u0022, \u0022path_pattern_hash\u0022: \u00228d06070e9c9922e376f5a87aad4d0fab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b53c935c53312af7502e6050d1ffa57c8ef71ce0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12572032,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53276,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022f0d8eecf3e972fd0e3f7a8fce92e2d8d58bd987f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 409, \u0022payload_entropy\u0022: 5.25387155190407, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002218f01e1f677d271e073644384de0181c444fe2cc\u0022, \u0022event_fingerprint\u0022: \u0022b646a129b82bf011a5085a1c9f057ecd08873f3c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a9760785a0e17f5067df5802105f13bb\u0022, \u0022path_pattern_hash\u0022: \u0022570e00ca8fa297c6c2ecbda5b086280c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022444860a13afd89933ea18cc0273be53925f6991c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":409},{"id":12572034,"ip":"15.160.33.6","ts":"2026-07-16 21:43:14.000000","proto":"tcp","src_port":53292,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/settings%2epy%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022e8aa58d373021c43cb2633d417ebd462bc4d5a6d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.139897584087851, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022c3915116bf786343bec487d4ab82b98a810382c2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022eb0425008364ad1c203b3fac1524f8b8\u0022, \u0022path_pattern_hash\u0022: \u002211582cbdb6718d89141ec3d325abff39\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bbd6da303cd9221f1e63d3ae971037c317d11eb5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12571979,"ip":"15.160.33.6","ts":"2026-07-16 21:43:13.000000","proto":"tcp","src_port":53060,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db_backup%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00221a1df8569a055e01dff547d2c91d80018b3c63fd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 380, \u0022payload_entropy\u0022: 5.166094376683648, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022416d594f842614812f8cf438661e212edc3eeebb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022647f2b8c485db5bddbde74dad290664b\u0022, \u0022path_pattern_hash\u0022: \u002226a995c3035b45deb7a329380dc9e8f2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db_backup%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db_backup%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002209a8ca586077cc027c6cffb6bbc3682b6010714c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db_backup%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db_backup%2eorig\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db_backup%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db_backup%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db_backup%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":380},{"id":12571981,"ip":"15.160.33.6","ts":"2026-07-16 21:43:13.000000","proto":"tcp","src_port":53074,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/sendgrid_keys%2epy","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022ad7c557a27f03efbb94ee075a06ecc82e512a9b0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.164869442189543, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022862c42437e74930e04591ff13c4c233471ac0fcb\u0022, \u0022event_fingerprint\u0022: \u0022a38d2456ddbc54656130cbb209237815874c2a42\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a6cb4948ff006c1d3642ca284521eeba\u0022, \u0022path_pattern_hash\u0022: \u002232cf6532ea9dead35d7ba09b806b2a1f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sendgrid_keys%2epy\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sendgrid_keys%2epy\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dfacac2b5b8fd3165080c77e1e2958f2040f09b7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sendgrid_keys%2epy\u0022, \u0022request_line\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sendgrid_keys%2epy\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sendgrid_keys%2epy\u0022, \u0022request_line\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sendgrid_keys%2epy\u0022, \u0022evidence_snippet\u0022: \u0022GET \/sendgrid_keys%2epy HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12571983,"ip":"15.160.33.6","ts":"2026-07-16 21:43:13.000000","proto":"tcp","src_port":53084,"dst_port":7022,"service":"http","classification":"config_file_probe","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backend\/phpinfo%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u00227a55745e8b12b180a3aacac8cac6645f60294342\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.180936133192691, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 81, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022a535d688a744f6e3888adac6dda5e4939a947a7d\u0022, \u0022event_fingerprint\u0022: \u0022da9523cd78ce197fd1cacca4623ae75b6b9f8f26\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a6c3954d8e0d13b1dc89cd0bd5b4b1ad\u0022, \u0022path_pattern_hash\u0022: \u002258c4c498db915d13692a6e962f174c12\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 81}, \u0022payload_preview\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224bf41cb6f211a23ada4cfd979ffca325e884031e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 81}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 81, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backend\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12571985,"ip":"15.160.33.6","ts":"2026-07-16 21:43:13.000000","proto":"tcp","src_port":53088,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backup%2eyaml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022ba4a41f51c1f3792ca8428cfb3c83cc2e8a2632f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.1688288848357535, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002291df34128376a4c1db38707f22ee8899eda17b22\u0022, \u0022event_fingerprint\u0022: \u00222b3cf4ddf3e483869aedae523aeb7760291b5276\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c03a4e30d0cda3eb427ed8e06b9703a3\u0022, \u0022path_pattern_hash\u0022: \u0022a943e05b882b279cef2f6f021456e7cd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224e12f1d384dabbcce4e2afc2bc8d11d38f241e3f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2eyaml\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2eyaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12571987,"ip":"15.160.33.6","ts":"2026-07-16 21:43:13.000000","proto":"tcp","src_port":53100,"dst_port":7022,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/data\/*","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u00224f712401f78fc064010a16683f21f84e7e961085\u0022, \u0022http_target_hash\u0022: \u0022dea9678fd4238325011b7306db4cac9f89f581eb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 374, \u0022payload_entropy\u0022: 5.122973308878493, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 7022, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 82, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223ea53a6f52f3d418bec2432daa9ec62bbf21177b\u0022, \u0022event_fingerprint\u0022: \u00225a95073c803d5f01849c687577281ac6338ecfac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a3932b7452d904bb47b1e37902a46442\u0022, \u0022path_pattern_hash\u0022: \u00221dd281a6b15ed2db90e8c09fc51672e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 82}, \u0022payload_preview\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/data\/*\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/data\/*\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225864846a079278d52bc20bdc79aa38e3fb176801\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/data\/*\u0022, \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/data\/*\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 82}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 82, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7022, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/data\/*\u0022, \u0022request_line\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 7022, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:7022 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/data\/*\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/data\/* HTTP\/1.1\\r\\nHost: 62.3.50.33:7022\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022target_port_label\u0022: \u00227022 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227022\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:7022","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":374}],"total_events":3000}