{"ip":"15.204.101.211","exported_at":"2026-07-29T01:20:03+00:00","period_days":7,"metrics":{"events7d":8,"distinct_ports":8,"distinct_classifications":8,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":40,"protocol":36,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":8,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 45\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":40,"protocol":36,"novelty":15,"risk_score":45},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd","port":23,"service":"telnet","service_label_fr":"Telnet"},"protocol_summary_fr":"Payload \u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\u2026 \u00b7 Telnet:23","evidence_snippet":"\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd","target_port_label":"23 \u00b7 Telnet","emulator_service":"telnet","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd"},"events":[{"id":14096205,"ip":"15.204.101.211","ts":"2026-07-28 09:31:54.000000","proto":"tcp","src_port":49013,"dst_port":23,"service":"telnet","classification":"telnet_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20\u0022, \u0022emulator_response_len\u0022: 45, \u0022bytes_in\u0022: 173, \u0022payload_entropy\u0022: 6.691684152417185, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022telnet\u0022, \u0022app_proto\u0022: \u0022telnet\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 23, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ee98e358747c5d752a0eb3d3b34c59d0ffe7f883\u0022, \u0022event_fingerprint\u0022: \u002279b983d64b1c5573cc70fb9163374500a6810d67\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002288eebd13f622a7f7fbb829aa4cb3465c\u0022, \u0022path_pattern_hash\u0022: \u00222c237ea9456e7ca12ad74a6740f8c26b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\\u001e\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\\u001ee,\ufffdW\u0148\ufffd\ufffd*\ufffd\ufffdAv\u06a3\ufffdw\\u000f\ufffd8\ufffd\ufffd\\u00005\ufffdJEx\ufffd\\ns5M\ufffdV6\ufffd\ufffd\ufffd\u0234G\ufffd\ufffd|\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\\u001ee,\ufffdW\u0148\ufffd\ufffd*\ufffd\ufffdAv\u06a3\ufffdw\\u000f\ufffd8\ufffd\ufffd\\u00005\ufffdJEx\ufffd\\ns5M\ufffdV6\ufffd\ufffd\ufffd\u0234G\ufffd\ufffd|\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bb8dd7e971425d75c5c00808622604c89a4376e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\u0022, \u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022, \u0022dst_port\u0022: 23, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\\u0000F\ufffd\\u001b\ufffdsk\ufffdB\ufffd\\u000b^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd\\b\\u0002*\ufffd\\u0007^\\u0018\ufffd_\\u001dF\ufffd\\u0006Y\ufffd\ufffd\ufffd_\\u0017\ufffd\u0022, \u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022attack_vector\u0022: \u0022telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)\u003EF\ufffd\ufffd^\ufffd\u003C{\ufffd\ufffdRrhl\ufffdJ\ufffdK\\\u0022\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\ufffd_\ufffd\\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022telnet\u0022, \u0022service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002223\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":173},{"id":14081109,"ip":"15.204.101.211","ts":"2026-07-28 06:52:23.000000","proto":"tcp","src_port":49039,"dst_port":20,"service":"ftp-data","classification":"ftp-data","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f7420465450205365727665722072656164792e0d0a\u0022, \u0022emulator_response_len\u0022: 32, \u0022bytes_in\u0022: 279, \u0022payload_entropy\u0022: 7.208843847493128, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022ftp-data\u0022, \u0022app_proto\u0022: \u0022ftp-data\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 20, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 2, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229bb9dc42b71fa9a8b139a710889461505f4a1426\u0022, \u0022event_fingerprint\u0022: \u0022c55c392bf4180d88834c6a8329c21cacd4db18d0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 2}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022ftp-data\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002248dcb8e67f0c4b4b3b34e7949ca65346\u0022, \u0022path_pattern_hash\u0022: \u00226ca40f5c7aca6091697dee3189e5f9fd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20, \u0022service\u0022: \u0022ftp-data\u0022, \u0022service_name\u0022: \u0022ftp-data\u0022, \u0022risk_score\u0022: 2}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\\u0007\ufffd\ufffd\ufffd\\u0006\ufffd\ufffdv\\u0010\ufffdy\ufffd\u05ae\ufffd\ufffd\\f\u0724+\\u000ft\ufffd\ufffd\\u001e\ufffd\ufffdC\\\u0022J\ufffd\ufffd\ufffdo\ufffd0\u0026\ufffdNa\\u0015[_\ufffd\ufffdH\ufffd9\\u0003M:\\u001b\ufffd\\u0002\\u001c\ufffdC\u61d9%+\ufffd|\u00f9\ufffd311\\u001d7\ufffd\ufffdY\\u001f|\ufffd\ufffd\ufffd\ufffd\\f)9\\b\ufffdy\ufffdA\ufffd:R\\u0002\ufffdv)(}\ufffd\ufffd\ufffd\\u0002\u0479\ufffd\u0463\\u001d\ufffdus`\ufffd\ufffd|:\ufffd%\\u0005h\ufffd\ufffdb\ufffd\ufffd\ufffds\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\\u0007\ufffd\ufffd\ufffd\\u0006\ufffd\ufffdv\\u0010\ufffdy\ufffd\u05ae\ufffd\ufffd\\f\u0724+\\u000ft\ufffd\ufffd\\u001e\ufffd\ufffdC\\\u0022J\ufffd\ufffd\ufffdo\ufffd0\u0026\ufffdNa\\u0015[_\ufffd\ufffdH\ufffd9\\u0003M:\\u001b\ufffd\\u0002\\u001c\ufffdC\u61d9%+\ufffd|\u00f9\ufffd311\\u001d7\ufffd\ufffdY\\u001f|\ufffd\ufffd\ufffd\ufffd\\f)9\\b\ufffdy\ufffdA\ufffd:R\\u0002\ufffdv)(}\ufffd\ufffd\ufffd\\u0002\u0479\ufffd\u0463\\u001d\ufffdus`\ufffd\ufffd|:\ufffd%\\u0005h\ufffd\ufffdb\ufffd\ufffd\ufffds\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224fbc0b5f44197a9fca8a28fc596ca08b13cb96b1\u0022, \u0022protocol_details\u0022: {\u0022ftp_auth_fr\u0022: \u0022Sonde protocole FTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022port\u0022: 20, \u0022service\u0022: \u0022ftp-data\u0022, \u0022service_label_fr\u0022: \u0022FTP DATA\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_EW\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdtl\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\ufffd%\ufffd\u0026\ufffdu\ufffd\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022attack_vector\u0022: \u0022ftp-data \u00b7 via FTP DATA:20 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002220 \u00b7 FTP DATA\u0022, \u0022emulator_service\u0022: \u0022ftp-data\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 2}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 2, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022ftp-data\u0022, \u0022service_label_fr\u0022: \u0022FTP DATA\u0022, \u0022dst_port\u0022: 20, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-ftp-data\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022ftp_auth_fr\u0022: \u0022Sonde protocole FTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\u0017\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_E\\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdt\\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\\u000e\ufffd\\u001e\\u0000%\\u000f\ufffd\u0026\\u0001\ufffdu\ufffd\\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022port\u0022: 20, \u0022service\u0022: \u0022ftp-data\u0022, \u0022service_label_fr\u0022: \u0022FTP DATA\u0022}, \u0022attack_vector\u0022: \u0022ftp-data \u00b7 via FTP DATA:20 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!\u0026_EW\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi\u0026g\ufffdo\ufffdtl\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\ufffd%\ufffd\u0026\ufffdu\ufffd\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP\u003E58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\\t}\ufffd\\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0022, \u0022target_port_label\u0022: \u002220 \u00b7 FTP DATA\u0022, \u0022emulator_service\u0022: \u0022ftp-data\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022ftp_data\u0022, \u0022service_banner\u0022: \u0022honeypot-ftp-data\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":279},{"id":14078559,"ip":"15.204.101.211","ts":"2026-07-28 06:21:33.000000","proto":"tcp","src_port":48977,"dst_port":25,"service":"smtp","classification":"smtp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a35303220352e352e32204572726f723a20636f6d6d616e64206e6f74207265636f676e697a65640d0a\u0022, \u0022emulator_response_len\u0022: 86, \u0022bytes_in\u0022: 104, \u0022payload_entropy\u0022: 6.26755942959635, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022smtp\u0022, \u0022app_proto\u0022: \u0022smtp\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 25, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 47.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 47.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e2a87a3a55cc3ea4df3dca9c8f4ae41683ef1c36\u0022, \u0022event_fingerprint\u0022: \u00223d09fc52d69030bda96b86438d4460cfb5a981fd\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 47.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022smtp\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e989ad74b5a09f1ca270da89a5308659\u0022, \u0022path_pattern_hash\u0022: \u00220585f924ca84c34a681a0e1500b9f97a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 25, \u0022service\u0022: \u0022smtp\u0022, \u0022service_name\u0022: \u0022smtp\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002250b84b0fae3c050df60bdf4918341c135b54f49c\u0022, \u0022protocol_details\u0022: {\u0022smtp_auth_fr\u0022: \u0022Sonde protocole SMTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022port\u0022: 25, \u0022service\u0022: \u0022smtp\u0022, \u0022service_label_fr\u0022: \u0022SMTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdh\ufffd\ufffd\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd2\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\ufffdX\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\ufffd}\ufffdm\ufffd\u0022, \u0022attack_vector\u0022: \u0022smtp probe \u00b7 via SMTP:25 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002225 \u00b7 SMTP\u0022, \u0022emulator_service\u0022: \u0022smtp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 47.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022smtp\u0022, \u0022service_label_fr\u0022: \u0022SMTP\u0022, \u0022dst_port\u0022: 25, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Postfix ESMTP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022smtp_auth_fr\u0022: \u0022Sonde protocole SMTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdh\\u0000\\u0000\\u0000\ufffd\ufffd\\u0002\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\\u001e2\\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\\u0012\\u0016\\u0001\ufffd\\u0007\\u0003\\u0003X\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\\u001a\ufffd}\ufffdm\ufffd\\u0016\u0022, \u0022port\u0022: 25, \u0022service\u0022: \u0022smtp\u0022, \u0022service_label_fr\u0022: \u0022SMTP\u0022}, \u0022attack_vector\u0022: \u0022smtp probe \u00b7 via SMTP:25 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdh\ufffd\ufffd\ufffdN\ufffd\ufffd\\n\ufffdj\ufffd\ufffd\ufffd\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm\u0026a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd\u003E\ufffd2\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\ufffdX\ufffd\u0260p\ufffd\ufffdU\\\u0022`:\ufffd}\ufffdm\ufffd\u0022, \u0022target_port_label\u0022: \u002225 \u00b7 SMTP\u0022, \u0022emulator_service\u0022: \u0022smtp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mail\u0022, \u0022service_banner\u0022: \u0022Postfix ESMTP\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002225\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_smtp_probe\u0022, \u0022smtp_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_smtp_probe\u0022, \u0022smtp_emulated\u0022]","anomalies":"[]","severity":4,"bytes_in":104},{"id":14066718,"ip":"15.204.101.211","ts":"2026-07-28 04:00:14.000000","proto":"tcp","src_port":49064,"dst_port":445,"service":"smb","classification":"smb_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002200000048\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 80, \u0022payload_entropy\u0022: 6.003055907333271, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022smb\u0022, \u0022app_proto\u0022: \u0022smb\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 445, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 32, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002290eadff6383eb9d1d8f3257adde4c79c467b3287\u0022, \u0022event_fingerprint\u0022: \u0022c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 32}, \u0022service_name\u0022: \u0022smb\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c9c2a65bd2f1e19714555001de3abbd2\u0022, \u0022path_pattern_hash\u0022: \u0022b6c073dc229e6284b4cae7886c46d504\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 445, \u0022service\u0022: \u0022smb\u0022, \u0022service_name\u0022: \u0022smb\u0022, \u0022risk_score\u0022: 32}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bcbe45eee30f45c45c391ad4836660f12ca18174\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022port\u0022: 445, \u0022service\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdP\ufffd\ufffd4\ufffdYD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\ufffdax\ufffd\\n\ufffd-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffdQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd?\ufffd\u0022, \u0022attack_vector\u0022: \u0022smb probe \u00b7 via SMB:445 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022445 \u00b7 SMB\u0022, \u0022emulator_service\u0022: \u0022smb\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 32\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 32}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 32, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022, \u0022dst_port\u0022: 445, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-smb\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffdP\\u0000\\u0000\\u0000\ufffd\ufffd4\\u0014\ufffd\\u000b\\u0010\\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\\u001c\ufffda\\u0018\\u0011\\u0011x\\u0006\ufffd\\n\ufffd\\b-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffd\\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\\u0012\ufffd\ufffd?\ufffd\u0022, \u0022port\u0022: 445, \u0022service\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022}, \u0022attack_vector\u0022: \u0022smb probe \u00b7 via SMB:445 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdP\ufffd\ufffd4\ufffdYD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\ufffdax\ufffd\\n\ufffd-\ufffd\ufffd\\\u0022q\/\ufffd \ufffd\ufffd\u003E\ufffdx\ufffdQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd?\ufffd\u0022, \u0022target_port_label\u0022: \u0022445 \u00b7 SMB\u0022, \u0022emulator_service\u0022: \u0022smb\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022smb\u0022, \u0022service_banner\u0022: \u0022honeypot-smb\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022445\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_smb_probe\u0022, \u0022smb_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_smb_probe\u0022, \u0022smb_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":80},{"id":14055118,"ip":"15.204.101.211","ts":"2026-07-28 01:33:07.000000","proto":"tcp","src_port":49028,"dst_port":3389,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 49, \u0022payload_entropy\u0022: 5.3952223440710565, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa4bea48009056c8c3884e795b29aa79232ecca7\u0022, \u0022event_fingerprint\u0022: \u0022707be242ce71f14fac23ca7fdd82d854dc2752d8\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bf256828f9c646fb952dcd0df3d26a0b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022310940207abab5366817123618c7b9222c9439e8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd^1@z\ufffd\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\ufffd\ufffd\ufffd4FG\ufffd[\ufffd=\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011^1\\u0000\\u0000\\u0000@\\u0006z\ufffd\\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\\u001c\ufffd\ufffd\ufffd4FG\ufffd[\\u001e\ufffd=\ufffd\ufffd\ufffd\\u001b\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd^1@z\ufffd\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\ufffd\ufffd\ufffd4FG\ufffd[\ufffd=\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdr\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":49},{"id":14050649,"ip":"15.204.101.211","ts":"2026-07-28 00:37:00.000000","proto":"tcp","src_port":48999,"dst_port":110,"service":"pop3","classification":"port_110_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00222b4f4b20504f503320686f6e6579706f742072656164790d0a\u0022, \u0022emulator_response_len\u0022: 25, \u0022bytes_in\u0022: 401, \u0022payload_entropy\u0022: 7.48918095775688, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022pop3\u0022, \u0022app_proto\u0022: \u0022pop3\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 110, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 38, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220bc29430209a1501e4a4048f59725d53efecdcd6\u0022, \u0022event_fingerprint\u0022: \u00228d5f083aa812a6762c3b48b8375cd32260924478\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022pop3_probe\u0022, \u0022service_name\u0022: \u0022pop3\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c9a361de219b688825ac29dbc23b5f1b\u0022, \u0022path_pattern_hash\u0022: \u0022dc4164b66ff59a3b1d171afce3368aeb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 110, \u0022service\u0022: \u0022pop3\u0022, \u0022service_name\u0022: \u0022pop3\u0022, \u0022risk_score\u0022: 38}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\/\u66eat.D\ufffd\ufffdJ!\\u000f\u0277\ufffd\\n\ufffd6e\u06f4\ufffd\ufffd\ufffd\\f\ufffd2\ufffde\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\\u0002a\ufffd\ufffd#K\ufffd\u076d\ufffd\\u001cTg@z*\uced6N\u003C\ufffd_\\u0016\ufffdB\\u000b\ufffd\ufffd\u0511\ufffd\ufffd1\\u000e\ufffd5m\\u001a(9\\u001a\ufffd\ufffd\ufffd\ufffdr\\u0010\ufffdV\ufffd]\ufffd08\ufffdV\ufffd\\u0017\ufffdE\ufffdV\ufffd\ufffd\ufffdpB4\ufffd\ufffd\u0680\ufffd\ufffd\ufffd:\\u0001\ufffde:\u0428\ufffd\\u0014\u003EH\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\/\u66eat.D\ufffd\ufffdJ!\\u000f\u0277\ufffd\\n\ufffd6e\u06f4\ufffd\ufffd\ufffd\\f\ufffd2\ufffde\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\\u0002a\ufffd\ufffd#K\ufffd\u076d\ufffd\\u001cTg@z*\uced6N\u003C\ufffd_\\u0016\ufffdB\\u000b\ufffd\ufffd\u0511\ufffd\ufffd1\\u000e\ufffd5m\\u001a(9\\u001a\ufffd\ufffd\ufffd\ufffdr\\u0010\ufffdV\ufffd]\ufffd08\ufffdV\ufffd\\u0017\ufffdE\ufffdV\ufffd\ufffd\ufffdpB4\ufffd\ufffd\u0680\ufffd\ufffd\ufffd:\\u0001\ufffde:\u0428\ufffd\\u0014\u003EH\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022793d9d1cb77f02d5e74d60c783a18e3187f6b829\u0022, \u0022protocol_details\u0022: {\u0022pop3_auth_fr\u0022: \u0022Sonde protocole POP3 (USER\/PASS)\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\u0022, \u0022port\u0022: 110, \u0022service\u0022: \u0022pop3\u0022, \u0022service_label_fr\u0022: \u0022POP3\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdK\ufffd\ufffd\ufffd\\n\\n,\ufffd\ufffdBLO\u0027o\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffdN!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd9\ufffd.\ufffd\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5l0\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\ufffd:6\ufffd\ufffd\ufffd5\u05d35#+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\\\u0022\u0022, \u0022attack_vector\u0022: \u0022port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022110 \u00b7 POP3\u0022, \u0022emulator_service\u0022: \u0022pop3\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 38\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 38, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pop3\u0022, \u0022service_label_fr\u0022: \u0022POP3\u0022, \u0022dst_port\u0022: 110, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pop3\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022pop3_auth_fr\u0022: \u0022Sonde protocole POP3 (USER\/PASS)\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010\ufffd\\u0001\\u0000\\u0000K\ufffd\ufffd\\u001b\ufffd\\n\\n\\b,\ufffd\\u001d\ufffdBLO\\b\u0027o\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd9\ufffd\ufffd\\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\\u00169\ufffd.\ufffd\\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\\u0014l0\\b\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\\u001c\ufffd\ufffd\\\u0022\\u0015\\u000f\u0022, \u0022port\u0022: 110, \u0022service\u0022: \u0022pop3\u0022, \u0022service_label_fr\u0022: \u0022POP3\u0022}, \u0022attack_vector\u0022: \u0022port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdK\ufffd\ufffd\ufffd\\n\\n,\ufffd\ufffdBLO\u0027o\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffdN!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd9\ufffd.\ufffd\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5l0\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\ufffd:6\ufffd\ufffd\ufffd5\u05d35#+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\\r\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\\\u0022\u0022, \u0022target_port_label\u0022: \u0022110 \u00b7 POP3\u0022, \u0022emulator_service\u0022: \u0022pop3\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pop3\u0022, \u0022service_banner\u0022: \u0022honeypot-pop3\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022110\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_pop3_probe\u0022, \u0022pop3_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_pop3_probe\u0022, \u0022pop3_emulated\u0022]","anomalies":"[]","severity":3,"bytes_in":401},{"id":14038404,"ip":"15.204.101.211","ts":"2026-07-27 21:57:36.000000","proto":"tcp","src_port":49031,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00225353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a\u0022, \u0022emulator_response_len\u0022: 40, \u0022bytes_in\u0022: 171, \u0022payload_entropy\u0022: 6.875197617111205, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 22, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 50.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ec742e1f26595cf120b330e5f862965c23dfeeb2\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022ssh\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022957e75f7b76e513baa1cb75507ab1494\u0022, \u0022path_pattern_hash\u0022: \u00224368b1c212b6962fb95d1d1144451aca\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_name\u0022: \u0022ssh\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffda\\u001c\ufffd=\ufffd8\ufffdI2f\\u000f;4\ufffd\u0322\ufffd\\u0005]\ufffd\ufffd#=\ufffdZU\\u0004\ufffd\ufffd-\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\ufffda\\u001c\ufffd=\ufffd8\ufffdI2f\\u000f;4\ufffd\u0322\ufffd\\u0005]\ufffd\ufffd#=\ufffdZU\\u0004\ufffd\ufffd-\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022add536979395171869637518a9bae56edc7e7345\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd.\ufffd\u01b3\ufffd\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\ufffd\ufffd\u0471\ufffdm\ufffd\ufffdAjO#\ufffd!\ufffd\ufffd1\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd[\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\\\\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffdEh`\ufffd0\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002222 \u00b7 SSH\u0022, \u0022emulator_service\u0022: \u0022ssh\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022, \u0022dst_port\u0022: 22, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022OpenSSH_8.9p1 Ubuntu\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0010.\ufffd\\u0000\\u0000\\u0000\u01b3\ufffd\\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\\u001a\\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\\u0001\\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\\u001b\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\u0015\\\\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\\u000e\\u0005Eh`\ufffd0\\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022}, \u0022attack_vector\u0022: \u0022Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd.\ufffd\u01b3\ufffd\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\ufffd\ufffd\u0471\ufffdm\ufffd\ufffdAjO#\ufffd!\ufffd\ufffd1\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd[\\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\\\\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\\\u0022~\ufffdz\u003E\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffdEh`\ufffd0\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002222 \u00b7 SSH\u0022, \u0022emulator_service\u0022: \u0022ssh\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022ssh\u0022, \u0022service_banner\u0022: \u0022OpenSSH_8.9p1 Ubuntu\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002222\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_ssh_probe\u0022, \u0022ssh_emulated\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_ssh_probe\u0022, \u0022ssh_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":171},{"id":14036655,"ip":"15.204.101.211","ts":"2026-07-27 21:37:48.000000","proto":"tcp","src_port":49198,"dst_port":21,"service":"ftp","classification":"ftp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a\u0022, \u0022emulator_response_len\u0022: 54, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.4193819456463714, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022ftp\u0022, \u0022app_proto\u0022: \u0022ftp\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 21, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 46.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 46.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220e3137812f19bf14aa1acaa110935b990e3b112f\u0022, \u0022event_fingerprint\u0022: \u002207fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 46.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022ftp\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002272eeae6d56e89e45fa0f2daac80ed921\u0022, \u0022path_pattern_hash\u0022: \u0022927e5cb33ffc245351b0aac1c306b95c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 21, \u0022service\u0022: \u0022ftp\u0022, \u0022service_name\u0022: \u0022ftp\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\\t\u0022, \u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\\t\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\\t\u0022, \u0022payload_snippet\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221a167fd382e50d4871115a74cf973edcbdb3a3b2\u0022, \u0022protocol_details\u0022: {\u0022ftp_auth_fr\u0022: \u0022Sonde protocole FTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 21, \u0022service\u0022: \u0022ftp\u0022, \u0022service_label_fr\u0022: \u0022FTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022ftp probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002221 \u00b7 FTP\u0022, \u0022emulator_service\u0022: \u0022ftp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 46.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022ftp\u0022, \u0022service_label_fr\u0022: \u0022FTP\u0022, \u0022dst_port\u0022: 21, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-ftp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022ftp_auth_fr\u0022: \u0022Sonde protocole FTP\u0022, \u0022payload_preview\u0022: \u0022\\u0010\ufffd\\u0011\ufffd\\t\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 21, \u0022service\u0022: \u0022ftp\u0022, \u0022service_label_fr\u0022: \u0022FTP\u0022}, \u0022attack_vector\u0022: \u0022ftp probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002221 \u00b7 FTP\u0022, \u0022emulator_service\u0022: \u0022ftp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022ftp\u0022, \u0022service_banner\u0022: \u0022honeypot-ftp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002221\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022ftp_emulated\u0022, \u0022net_ftp_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ftp_emulated\u0022, \u0022net_ftp_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9}],"total_events":8}