{"ip":"151.243.11.150","exported_at":"2026-10-24T23:32:26+00:00","period_days":30,"metrics":{"events7d":10,"distinct_ports":2,"distinct_classifications":5,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":22,"max_risk_score":56,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ssrf_probe","IP signal\u00e9e (IPsum, 3 listes ou plus)"],"recommended_action":"investigate","confidence":0.5,"risk_breakdown":{"waf":96,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0007","top_mitre_count":8,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":96,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":56},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["Upstream","Waf Score"],"tags_summary":["INT-upstream","INT-waf-score"],"attack_vector":"ssrf attack \u00b7 via HTTP:10801 \u00b7 (tentative d\u0027exploit)","protocol_details":{"http_method":"GET","http_path":"\/","request_line":"GET \/ HTTP\/1.1","http_user_agent":"Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)","port":10801,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/ \u00b7 UA Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +ht\u2026 \u00b7 HTTP:10801","evidence_snippet":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info","target_port_label":"10801 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 50 % \u2014 4 tag(s) WAF","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","classification_reason_label_fr":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF","payload_preview":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"150.11.243.151.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":7118124,"ip":"151.243.11.150","ts":"2026-10-23 12:19:28.000000","proto":"tcp","src_port":43723,"dst_port":10801,"service":"http","classification":"ssrf_attack","waf_score":22,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00222cce74947ae104861c6404693b60cc04c0330b1d\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 165, \u0022payload_entropy\u0022: 5.222494310506847, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 10801, \u0022risk_waf\u0022: 96.0, \u0022risk_classification\u0022: 84.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 96.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 56, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222f23b42a08f88992adbbdbdfa649c4990e48e2bf\u0022, \u0022event_fingerprint\u0022: \u0022c08bf8bbe403ff56230f2110791ccf666cfb84cc\u0022, \u0022classification_reason\u0022: \u0022R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 55, \u0022precision_signals\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 96.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 56}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002283dce64baa2f0543cbc5015d0224fa45\u0022, \u0022payload_hash\u0022: \u002225e1dbb9dc3e9dd092f07b00f8ffcace\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10801, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 56}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info\u0022, \u0022classification_reason\u0022: \u0022R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ssrf_probe\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002264124550e3425c50ee1428c55a60e1a4e2c901c4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\u0022, \u0022port\u0022: 10801, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info\u0022, \u0022attack_vector\u0022: \u0022ssrf attack \u00b7 via HTTP:10801 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u002210801 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 96.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 56}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 56, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 10801, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\u0022, \u0022port\u0022: 10801, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf attack \u00b7 via HTTP:10801 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info\u0022, \u0022target_port_label\u0022: \u002210801 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210801\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":10,"bytes_in":165},{"id":5468123,"ip":"151.243.11.150","ts":"2026-10-20 18:03:37.000000","proto":"tcp","src_port":51353,"dst_port":1883,"service":"mqtt","classification":"ssrf_internal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 18, \u0022payload_entropy\u0022: 3.6143694458867563, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002260f42ca5f8e510628d4ca7f43335030d7f8f1795\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c1d61ae61efafa16c783e5ac5975fba3\u0022, \u0022path_pattern_hash\u0022: \u00222926fa5ba65a298fe7630f4e1d1dd6ea\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227fdc18b9943fda87628c55b92bfd6eebda5267f4\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022\/\\tlocalhostc\ufffd\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via MQTT:1883 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via MQTT \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u000f\\u0000\/\\tlocalhostc\ufffd\\u0001\\u0001\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via MQTT:1883 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\/\\tlocalhostc\ufffd\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mqtt_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mqtt_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":18},{"id":5468122,"ip":"151.243.11.150","ts":"2026-10-20 18:03:37.000000","proto":"tcp","src_port":47313,"dst_port":1883,"service":"mqtt","classification":"mqtt_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 12, \u0022payload_entropy\u0022: 0.8166890883150209, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222b9bbbb72fbabc84fedf9d5001296def18138d70\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0768\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ad33d13d6bc3bd05c9957f130811a989\u0022, \u0022path_pattern_hash\u0022: \u00224449b927317468afa12a2f935a413459\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022601cb8f90d5a599da543d2f85bbdc76632efbaf5\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022l\u0022, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0768\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0768\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022l\\u0000\\u000b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022l\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":12},{"id":5468121,"ip":"151.243.11.150","ts":"2026-10-20 18:03:37.000000","proto":"tcp","src_port":58997,"dst_port":1883,"service":"mqtt","classification":"mqtt_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 123, \u0022payload_entropy\u0022: 4.125261783562761, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222b9bbbb72fbabc84fedf9d5001296def18138d70\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226c87f427e47cfdb06f322988e3e2f717\u0022, \u0022path_pattern_hash\u0022: \u00224449b927317468afa12a2f935a413459\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\u0022, \u0022request_sample\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d9dec398f04acfbc4390076302edb24bd0e32be3\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\ufffd.{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003%\\u0000\\u0000\\u0000{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0003.\\u0000\\u0000\\u0000{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%{ \\\u0022Ret\\\u0022 : 100, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\\n\ufffd\ufffd.{ \\\u0022Name\\\u0022 : \\\u0022KeepAlive\\\u0022, \\\u0022SessionID\\\u0022 : \\\u00220x0\\\u0022 }\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":123},{"id":5468107,"ip":"151.243.11.150","ts":"2026-10-20 18:03:36.000000","proto":"tcp","src_port":54545,"dst_port":1883,"service":"mqtt","classification":"sip_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 317, \u0022payload_entropy\u0022: 5.368027592492071, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222b9bbbb72fbabc84fedf9d5001296def18138d70\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0384\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0384\u0022], \u0022matched_patterns\u0022: [\u0022pat-0384\u0022, \u0022pat-0420\u0022, \u0022pat-0535\u0022], \u0022matched_pattern_names\u0022: [\u0022SIP protocol\u0022, \u0022HTTP OPTIONS method\u0022, \u0022SIP OPTIONS\u0022], \u0022pattern_ids\u0022: [\u0022pat-0384\u0022, \u0022pat-0420\u0022, \u0022pat-0535\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222e063497e9e0b429309ee54b7abf1196\u0022, \u0022path_pattern_hash\u0022: \u0022850113ca2503ddab2e70a7e8c1732065\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022request_sample\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scanner@62.3.50.33\u003E;tag=9e0fd937\\r\\nTo: \u003Csip:62.3.50.33:1883\u003E\\r\\nCall-ID: 9e0fd937@62.3.50.33\\r\\nCSeq: 1 OPTIONS\\r\\nContact: \u003Csip:scanner@62.\u0022, \u0022payload_snippet\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scanner@62.3.50.33\u003E;tag=9e0fd937\\r\\nTo: \u003Csip:62.3.50.33:1883\u003E\\r\\nCall-ID: 9e0fd937@62.3.50.33\\r\\nCSeq: 1 OPTIONS\\r\\nContact: \u003Csip:scanner@62.\u0022, \u0022payload_snippet\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228893f7987bb2da16688eee8a6937b21e4fb3056e\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022attack_vector\u0022: \u0022sip probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0384\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0384\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022sip probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022OPTIONS sip:62.3.50.33:1883 SIP\/2.0\\r\\nVia: SIP\/2.0\/TCP 62.3.50.33:1883;branch=z9hG4bK9e0fd937\\r\\nMax-Forwards: 70\\r\\nFrom: \u003Csip:scann\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":317},{"id":5468105,"ip":"151.243.11.150","ts":"2026-10-20 18:03:36.000000","proto":"tcp","src_port":37341,"dst_port":1883,"service":"mqtt","classification":"port_1883_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 18, \u0022payload_entropy\u0022: 1.9447167900528528, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222b9bbbb72fbabc84fedf9d5001296def18138d70\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_1883_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fbf899051d421f03b3e5dbc4f66179d8\u0022, \u0022path_pattern_hash\u0022: \u00228a58663cc6ef426137d80f7d6f0d7768\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_1883_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a1f67ff0e9221818ba7dac2f447428d17b66b07e\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u0022, \u0022attack_vector\u0022: \u0022port 1883 tcp \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_1883_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_1883_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 41\/100\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\\u0013\\u000e\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022port 1883 tcp \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":18},{"id":5468101,"ip":"151.243.11.150","ts":"2026-10-20 18:03:36.000000","proto":"tcp","src_port":58987,"dst_port":1883,"service":"mqtt","classification":"mqtt_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 6, \u0022payload_entropy\u0022: 2.584962500721156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221627c74183ff52de391c79aa877f52b36720c401\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dedee95a5c3354a76fa11ee26963cbe7\u0022, \u0022path_pattern_hash\u0022: \u00224449b927317468afa12a2f935a413459\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022PING\\r\\n\u0022, \u0022request_sample\u0022: \u0022PING\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022PING\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022PING\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022PING\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c39bb92cfbf2224f2692a44c8cc8eba3675e9e50\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022PING\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022PING\u0022, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022PING\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022PING\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022redis_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022redis_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":6},{"id":5468097,"ip":"151.243.11.150","ts":"2026-10-20 18:03:36.000000","proto":"tcp","src_port":58153,"dst_port":1883,"service":"mqtt","classification":"mqtt_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 21, \u0022payload_entropy\u0022: 3.368042422572715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d014c584193d9de9bee57ec1499be85ce125fcf7\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223b3b7f62e257a82197cc83b9f1054c84\u0022, \u0022path_pattern_hash\u0022: \u00224449b927317468afa12a2f935a413459\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002255384e50c8c37f395856845f6ccd9efc22e42b78\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022Pexample.com\u0022, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0000P\\u0000\\u0000\\u0000\\u0001\\u0000example.com\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022Pexample.com\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022socks4_greeting\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022socks4_greeting\u0022]","anomalies":"[]","severity":5,"bytes_in":21},{"id":5468093,"ip":"151.243.11.150","ts":"2026-10-20 18:03:35.000000","proto":"tcp","src_port":42409,"dst_port":1883,"service":"mqtt","classification":"mqtt_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 3, \u0022payload_entropy\u0022: 1.584962500721156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221764cd44566ed9fdd6997ce9c9d0305027b29fd0\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022da075e9d699084fc189cdd233081c49f\u0022, \u0022path_pattern_hash\u0022: \u00224449b927317468afa12a2f935a413459\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223f4bbeb7a8504ce2d69458188fdd90d6c8fb398a\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022mqtt probe \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022socks5_greeting\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022socks5_greeting\u0022]","anomalies":"[]","severity":5,"bytes_in":3},{"id":5468091,"ip":"151.243.11.150","ts":"2026-10-20 18:03:35.000000","proto":"tcp","src_port":46503,"dst_port":1883,"service":"mqtt","classification":"port_1883_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 740, \u0022payload_entropy\u0022: 4.900696794969122, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022mqtt\u0022, \u0022app_proto\u0022: \u0022mqtt\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 1883, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002297b0130b0dbbf52428bd86f1342ade30be72779e\u0022, \u0022event_fingerprint\u0022: \u0022cfbc4bf6c6ba306df7f60198b2c1e3ee0dcb8f30\u0022, \u0022classification_reason\u0022: \u0022Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0391\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0391\u0022], \u0022matched_patterns\u0022: [\u0022pat-0391\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022SSH-2.0 banner RFC4253\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0391\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022ssh_probe\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c12830ff04b0c3570e597703d1963b4f\u0022, \u0022path_pattern_hash\u0022: \u00228a58663cc6ef426137d80f7d6f0d7768\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022request_sample\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss\\u0000\\u0000\\u0000\ufffdchacha20-poly1305@openssh.com,aes128-ctr,ae\u0022, \u0022payload_snippet\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss\\u0000\\u0000\\u0000\ufffdchacha20-poly1305@openssh.com,aes128-ctr,ae\u0022, \u0022payload_snippet\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022classification_reason\u0022: \u0022Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b193c5eab1a8c009e859ef1f94cc361ada6a14ae\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022evidence_snippet\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\ufffd.curve25519-sha256,curve25519-sha256@libssh.orgqssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022attack_vector\u0022: \u0022port 1883 tcp \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 41\/100\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022, \u0022dst_port\u0022: 1883, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0391\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0391\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022mqtt_connect_fr\u0022: \u0022Connexion MQTT (CONNECT)\u0022, \u0022payload_preview\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\\u0000\\u0000\\u0002\ufffd\\b\\u0014\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000.curve25519-sha256,curve25519-sha256@libssh.org\\u0000\\u0000\\u0000qssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022port\u0022: 1883, \u0022service\u0022: \u0022mqtt\u0022, \u0022service_label_fr\u0022: \u0022MQTT\u0022}, \u0022attack_vector\u0022: \u0022port 1883 tcp \u00b7 via MQTT:1883 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022SSH-2.0-FlowIQ_1.0\\r\\n\ufffd.curve25519-sha256,curve25519-sha256@libssh.orgqssh-ed25519,rsa-sha2-512,rsa-sha\u0022, \u0022target_port_label\u0022: \u00221883 \u00b7 MQTT\u0022, \u0022emulator_service\u0022: \u0022mqtt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mqtt\u0022, \u0022service_banner\u0022: \u0022MQTT 3.1.1\u0022, \u0022service_os\u0022: \u0022iot\u0022, \u0022dst_port\u0022: \u00221883\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022ssh_banner\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mqtt_emulated\u0022, \u0022mqtt_payload\u0022, \u0022net_mqtt_probe\u0022, \u0022ssh_banner\u0022]","anomalies":"[]","severity":5,"bytes_in":740}],"total_events":10}