152.32.128.85

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.662494942126659,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10124,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "19a3c7b31248d5b0b4e81c9685c78af8f94f02dd",
    "event_fingerprint": "5ff653cc77757dc93a071d97f21e90eefbe4589d",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "25d6ca7ef98b6dcc490b5814befd9586",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 10124,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd^3\ufffd\ufffd\ufffd%+\u001dc\ufffd5cA\ufffd\u001c*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd \u0007.h\ufffdf\ufffda\u0005\u00143Z\ufffd\ufffd$\u0003\u0011\ufffd\ufffd\ufffd\ufffd\u0014\n\ufffd\ufffd\b\ufffd\u0010\/55\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd^3\ufffd\ufffd\ufffd%+\u001dc\ufffd5cA\ufffd\u001c*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd \u0007.h\ufffdf\ufffda\u0005\u00143Z\ufffd\ufffd$\u0003\u0011\ufffd\ufffd\ufffd\ufffd\u0014\n\ufffd\ufffd\b\ufffd\u0010\/55\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000e\ufffd\ufffd^\ufffd\u07b8>\u00020\ufffd\ufffdD\ufffd&e\ufffdE\u0161\u0016\u001bRo>\ufffd\u0016\ufffd\u0018\ufffd\t",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd^3\ufffd\ufffd\ufffd%+\u001dc\ufffd5cA\ufffd\u001c*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd \u0007.h\ufffdf\ufffda\u0005\u00143Z\ufffd\ufffd$\u0003\u0011\ufffd\ufffd\ufffd\ufffd\u0014\n\ufffd\ufffd\b\ufffd\u0010\/55\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f80f5a95c6492b2846b9424b7b494953e8876a33",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd^3\ufffd\ufffd\ufffd%+\u001dc\ufffd5cA\ufffd\u001c*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd \u0007.h\ufffdf\ufffda\u0005\u00143Z\ufffd\ufffd$\u0003\u0011\ufffd\ufffd\ufffd\ufffd\u0014\n\ufffd\ufffd\b\ufffd\u0010\/55\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 10124,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^3\ufffd\ufffd\ufffd%+c\ufffd5cA\ufffd*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd .h\ufffdf\ufffda3Z\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\/55&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:10124 \u00b7 (sonde \/ probe)",
    "target_port_label": "10124 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 10124,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd^3\ufffd\ufffd\ufffd%+\u001dc\ufffd5cA\ufffd\u001c*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd \u0007.h\ufffdf\ufffda\u0005\u00143Z\ufffd\ufffd$\u0003\u0011\ufffd\ufffd\ufffd\ufffd\u0014\n\ufffd\ufffd\b\ufffd\u0010\/55\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 10124,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:10124 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^3\ufffd\ufffd\ufffd%+c\ufffd5cA\ufffd*\ufffd*\ufffd\ufffd\ufffd\ufffdq`\ufffdc\ufffd .h\ufffdf\ufffda3Z\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\/55&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "10124 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "10124"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:10124",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 10124,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e212eb7806722c5d72d70073f64ad6173bf3d90b",
    "event_fingerprint": "856839af09b17a1019d61c3de001929ce6acd02f",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 10124,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eecf0d96dddbd948947a506a832f81209fd7ed4f",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 10124
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 10124 \u00b7 (sonde \/ probe)",
    "target_port_label": "10124",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10124,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 10124
        },
        "attack_vector": "Sonde port \u00b7 port 10124 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "10124",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10124"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:10124",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10124,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "1578aab8b8a8012c47d80702c9d23163817691a3",
    "event_fingerprint": "80777deec833ed43c1fb2b7d7053f390171fad1f",
    "classification_reason": "Type \u00ab port_10124_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 10124,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_10124_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aed373ee951b5f4e53f15a63e5e2596688ff7002",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 10124,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 10124 tcp \u00b7 via HTTP:10124 \u00b7 (sonde \/ probe)",
    "target_port_label": "10124 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_10124_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_10124_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10124,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 10124,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 10124 tcp \u00b7 via HTTP:10124 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "10124 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10124"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:10124"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 10124,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e212eb7806722c5d72d70073f64ad6173bf3d90b",
    "event_fingerprint": "856839af09b17a1019d61c3de001929ce6acd02f",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 10124,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bdb911132d690c35eb37e0562e04169263cf36da",
    "protocol_details": {
        "port": 10124
    },
    "attack_vector": "Sonde port \u00b7 port 10124 \u00b7 (sonde \/ probe)",
    "target_port_label": "10124",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10124,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 10124
        },
        "attack_vector": "Sonde port \u00b7 port 10124 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "10124",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10124"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "199013d2bdd6000812aa164e32edbc543325a26a",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.912452571223997,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "800c10999fea5eb3383ef97b2a26177ba2c766f0",
    "event_fingerprint": "ad753929b92d5fda654a316cb59222b590231cf9",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "1d35ced8dd88e00252b224cdec2085a6",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 32034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "515f804bbd23bf9272049ad46bd476863f7f907b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "32034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "199013d2bdd6000812aa164e32edbc543325a26a",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 4.971282400419941,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "800c10999fea5eb3383ef97b2a26177ba2c766f0",
    "event_fingerprint": "b1a81804d6687766c9b421afb14929822635e565",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "b379c25451aad19fd6b04b194ad178e9",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 32034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "184ad87d1ed4594bbe6613c060ddd46d4c323072",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "32034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "72eccd94e586aab5bb930306cfebb7fda1c6ce3a",
    "http_host_hash": "199013d2bdd6000812aa164e32edbc543325a26a",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 210,
    "payload_entropy": 5.374627687975425,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32034,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "223cf19efb6ee8d7ac006316175dc9c8dc98819f",
    "event_fingerprint": "2b8b6f06f878cda8b4dea5a50ddda34e011559d0",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e5f2320b45d89ba7e3058686721bf481",
        "payload_hash": "2357e919319f0843e90c9c1ee989ff9d",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 32034,
        "service": "http",
        "service_name": "http",
        "risk_score": 45
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like ",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4bde6bab0d3b7bf4bedb040b50b15f87482d2313",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36",
        "port": 32034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like",
    "attack_vector": "exploit attempt \u00b7 via HTTP:32034 \u00b7 (tentative d'exploit)",
    "target_port_label": "32034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32034,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like Gecko) Chrome\/56.0.647 Safari\/537.36",
            "port": 32034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:32034 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0) AppleWebKit\/593.44 (KHTML, like",
        "target_port_label": "32034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "199013d2bdd6000812aa164e32edbc543325a26a",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 4.928024427401647,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "800c10999fea5eb3383ef97b2a26177ba2c766f0",
    "event_fingerprint": "0bffb82e07c1d43f3f07e0e09dc634f1a15d0653",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "ca9dfb6ebf77bcb7e47c7f452353dbe0",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 32034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "93102eb9e9cf160af747c6b6d68ebed2ec7e2c71",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "32034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 20321,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "dbee23eb961c70447a9e01958859391dc0d46f96",
    "event_fingerprint": "eed06b26fe4911b398884c8330d16e9874adec15",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 20321,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3d602fcc6e6a170e10d49be1a348c66838299a03",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 20321
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 20321 \u00b7 (sonde \/ probe)",
    "target_port_label": "20321",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 20321,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 20321
        },
        "attack_vector": "Sonde port \u00b7 port 20321 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "20321",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "20321"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:20321",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 20321,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "f3f4df99aaf5145cab936dfb867e24432e1f2bf5",
    "event_fingerprint": "8e8fd85e965ac07441b49a22af04ae3a96f4d410",
    "classification_reason": "Type \u00ab port_20321_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 20321,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_20321_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bb151da6dee6ee6b908adbce4e990d7c137211c8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 20321,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 20321 tcp \u00b7 via HTTP:20321 \u00b7 (sonde \/ probe)",
    "target_port_label": "20321 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_20321_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_20321_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 20321,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 20321,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 20321 tcp \u00b7 via HTTP:20321 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "20321 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "20321"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:20321"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.8190578346896435,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "HK",
    "dst_port": 20321,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "23e15a5e8ec6e053374932bf839542436138f058",
    "event_fingerprint": "3bee3b41d60d6ebd0620dd6224c0870a8ab9fc9f",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "c25d669e4c143183c6a822a666d8e3d5",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 20321,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd{\ufffd\ufffd\u001a\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffd(\u01a7\u001e\ufffd>\ufffdX\ufffd \ufffd\u0006\ufffd`.\ufffd\ufffd\ufffd\u0572\u0018\u001ci\u0015\u0004\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd{\ufffd\ufffd\u001a\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffd(\u01a7\u001e\ufffd>\ufffdX\ufffd \ufffd\u0006\ufffd`.\ufffd\ufffd\ufffd\u0572\u0018\u001ci\u0015\u0004\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001e\ufffd\ufffd\u0758T\ufffdn\ufffd\u8190\ufffd\ufffd\ufffd\ufffdL\/e\ufffd0B\ufffd\u0003\u0007Y\ufffd\ufffd1r",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd{\ufffd\ufffd\u001a\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffd(\u01a7\u001e\ufffd>\ufffdX\ufffd \ufffd\u0006\ufffd`.\ufffd\ufffd\ufffd\u0572\u0018\u001ci\u0015\u0004\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c2fe4283935ddf6ac168ae9f7e06609e7a91c97f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd{\ufffd\ufffd\u001a\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffd(\u01a7\u001e\ufffd>\ufffdX\ufffd \ufffd\u0006\ufffd`.\ufffd\ufffd\ufffd\u0572\u0018\u001ci\u0015\u0004\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 20321,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\u01a7\ufffd>\ufffdX\ufffd \ufffd\ufffd`.\ufffd\ufffd\ufffd\u0572i\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:20321 \u00b7 (sonde \/ probe)",
    "target_port_label": "20321 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 20321,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd{\ufffd\ufffd\u001a\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffd(\u01a7\u001e\ufffd>\ufffdX\ufffd \ufffd\u0006\ufffd`.\ufffd\ufffd\ufffd\u0572\u0018\u001ci\u0015\u0004\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 20321,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:20321 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd8U\ufffdP_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\u01a7\ufffd>\ufffdX\ufffd \ufffd\ufffd`.\ufffd\ufffd\ufffd\u0572i\ufffd\ufffd$~\ufffd\ufffd$vxg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "20321 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "20321"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:20321",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 20321,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "dbee23eb961c70447a9e01958859391dc0d46f96",
    "event_fingerprint": "eed06b26fe4911b398884c8330d16e9874adec15",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 20321,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d8f7d209c06f71957b76b45a23bdb23739abdf35",
    "protocol_details": {
        "port": 20321
    },
    "attack_vector": "Sonde port \u00b7 port 20321 \u00b7 (sonde \/ probe)",
    "target_port_label": "20321",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 20321,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 20321
        },
        "attack_vector": "Sonde port \u00b7 port 20321 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "20321",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "20321"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "86e7a9102ca599b14fc8ffa2bd0cef6e791321ee",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 5.0125824988281025,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10479,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3a3ecf7ec16dfb52406dd39a650259cde3c4af39",
    "event_fingerprint": "e934fcbcc2413896d3934061b2dbb1316dd90305",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "d9e41c91e12cc5f6a4c52f124a4d1b5b",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 10479,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e8f43c6bf5e47413317eaa24dc0cbd6314cd515c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 10479,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "10479 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10479,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 10479,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "10479 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10479"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "86e7a9102ca599b14fc8ffa2bd0cef6e791321ee",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.954080448190953,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10479,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3a3ecf7ec16dfb52406dd39a650259cde3c4af39",
    "event_fingerprint": "e811d63cd50fe1f16c5d2070140b6eb4f9f1326e",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "e50d14430d6404ff7c5799fd288d7f9f",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 10479,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "596a276b79e942f1bcf5c9b6eae5145bb75eee53",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 10479,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "10479 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10479,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 10479,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "10479 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10479"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "affd6ccdd5f1fdb354517ff9dfa87ebc0855bbac",
    "http_host_hash": "86e7a9102ca599b14fc8ffa2bd0cef6e791321ee",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 212,
    "payload_entropy": 5.424433217564615,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10479,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 43,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "915741bdee29e47d1bb559ee32782bd35d65b6a8",
    "event_fingerprint": "36b097233a87995edef767cfaf45cf5b6cfbd22a",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 43
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2be6d5432a30f85e986e5353a1ad1030",
        "payload_hash": "549957bf5c8e74ce43a960dedad73f83",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 10479,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, lik",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, lik",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, lik",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "11c7fc28d8b105019e2044830618dd46074b6dcc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36",
        "port": 10479,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, lik",
    "attack_vector": "exploit attempt \u00b7 via HTTP:10479 \u00b7 (tentative d'exploit)",
    "target_port_label": "10479 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 43
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10479,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, like Gecko) Chrome\/62.0.981 Safari\/537.36",
            "port": 10479,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:10479 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit\/579.44 (KHTML, lik",
        "target_port_label": "10479 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10479"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "86e7a9102ca599b14fc8ffa2bd0cef6e791321ee",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 4.969324525809809,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 10479,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3a3ecf7ec16dfb52406dd39a650259cde3c4af39",
    "event_fingerprint": "0fc59a8d6e523a452d1248b7dd0c038a002ebc44",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "8924ff5b279fc8753c63dd95d606df22",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 10479,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "521985768d036b6361744ff42548a387687430d2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 10479,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "10479 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10479,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 10479,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:10479 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10479\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "10479 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10479"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "ed35e760c102b726c835dae21f81f178a1a5910e",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 4.956446793342095,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32785,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3d8ad049ac3761ea1eac379e38562f38d1f31887",
    "event_fingerprint": "c172cd8ec9dd482a9f5fd76c588c7dfdf256aaca",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "b1f893cfdd3be9180a71c5afc08cf13c",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 32785,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bb682237e1f2db94c6c500863b0ded43efc29be3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32785,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "32785 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32785,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32785,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32785 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32785"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "ed35e760c102b726c835dae21f81f178a1a5910e",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 4.999704766360388,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32785,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3d8ad049ac3761ea1eac379e38562f38d1f31887",
    "event_fingerprint": "53acd482a5e1785c98dba5bb04db9dd945dfebdd",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "bf16477955cb2f04d339bed8a4c5c996",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 32785,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a10fa6dd11b20ee150d2764319f8f427bc1abf09",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32785,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "32785 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32785,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32785,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32785 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32785"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "ed35e760c102b726c835dae21f81f178a1a5910e",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.941100511497305,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32785,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3d8ad049ac3761ea1eac379e38562f38d1f31887",
    "event_fingerprint": "d42cdbbcd8dec827f8fd750b59bb2c6f0b1aad72",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "80cfe7b5d2fe2cdd5dffa1b74fbfde6d",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 32785,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e41901cbc637bc197cc8ae8f262162ff61318d99",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 32785,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "32785 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32785,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 32785,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:32785 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "32785 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32785"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "ab0d260084758014a9b19880559014faf8fe0c5b",
    "http_host_hash": "ed35e760c102b726c835dae21f81f178a1a5910e",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.439046161789316,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 32785,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "aaf3e0fd5dd45761b6157ed61382358e7a09f6e3",
    "event_fingerprint": "b66ba844d1292f1271628cd753043276c78c768d",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2b62d90ff573b76c10e01b1f2e64279e",
        "payload_hash": "37738a0fa3031afd5fd720375ea75035",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 32785,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrom",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrom",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrom",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cc80e13eca238f6861c6dbc3173522d19435d7fd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36",
        "port": 32785,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrom",
    "attack_vector": "exploit attempt \u00b7 via HTTP:32785 \u00b7 (tentative d'exploit)",
    "target_port_label": "32785 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 32785,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrome\/69.0.268 Safari\/537.36",
            "port": 32785,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:32785 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32785\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/582.37 (KHTML, like Gecko) Chrom",
        "target_port_label": "32785 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "32785"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9f8842ec413b7b9aa6a5a715aaeb574483166ac8",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.9141143611243345,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 142,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ec9e6f087154df486e3f72cb291a3243b29d8750",
    "event_fingerprint": "c8ddbebc99960ba07910021bdc74bcc91fcd2b94",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "be8a6aad629e907e4a49ab37a3e8ad86",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 142,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0697fb4de6f86da131fb603ed5ff577ef0d2ad8c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 142,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "142 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 142,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 142,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "142 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "142"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9f8842ec413b7b9aa6a5a715aaeb574483166ac8",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 124,
    "payload_entropy": 4.898364585476153,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 142,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ec9e6f087154df486e3f72cb291a3243b29d8750",
    "event_fingerprint": "e3d4bde813c6ca1b254dcf6cce38bebbbba9dde2",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "4fb7ed8573c0774dc040a03b9d3f4cb6",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 142,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dc257cf9cece65e9afd5e39afea244cf4170b3d4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 142,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "142 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 142,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 142,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "142 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "142"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9f8842ec413b7b9aa6a5a715aaeb574483166ac8",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.958064461710921,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 142,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ec9e6f087154df486e3f72cb291a3243b29d8750",
    "event_fingerprint": "192013e892d5a0afb930abb5607800c52a5575ca",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "456c6dd61a1bf3e34281b2da369e03cc",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 142,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "88aa0d4dfea6fd4ae68f16a6d4cd05d8f21f98be",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 142,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "142 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 142,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 142,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:142 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "142 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "142"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "9222deec9ecde83170774905bdb063c231f2fa13",
    "http_host_hash": "9f8842ec413b7b9aa6a5a715aaeb574483166ac8",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 197,
    "payload_entropy": 5.408620353882366,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 142,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b04c28034115abadf03202a25a3974b8dd839209",
    "event_fingerprint": "59079aa97fae10097616cb8b2f717f5d7c8492a9",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fccd92fa78385b2d74abaff5c7e5857f",
        "payload_hash": "8c5867797a780643b2528e5d49a0ffe1",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 142,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "69ff35c2d07dcb47541837f1e4abd337a5bd2f28",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36",
        "port": 142,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:142 \u00b7 (tentative d'exploit)",
    "target_port_label": "142 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 142,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/62.0.1235 Safari\/537.36",
            "port": 142,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:142 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:142\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/572.36 (KHTML, like Gecko) Chrome\/",
        "target_port_label": "142 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "142"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 4913,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4546758b5f882322634a53817068a1298abf4d80",
    "event_fingerprint": "a1ba0e80f1129f72c5d5ba588fc65be582ee0dc6",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 4913,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6bc8ecb63537e8a7212f7e7a0b14b0d04e2b4dd",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 4913
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 4913 \u00b7 (sonde \/ probe)",
    "target_port_label": "4913",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4913,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 4913
        },
        "attack_vector": "Sonde port \u00b7 port 4913 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "4913",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4913"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:4913",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 4913,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "e3e6ed3b5742fb88151867059d2d0ae09f269201",
    "event_fingerprint": "83ea6ab6bd10694654febb93238ba9434dbbdb04",
    "classification_reason": "Type \u00ab port_4913_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 4913,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_4913_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b1e39a5c7ecb7889b5792136cf81840094be66c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 4913,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 4913 tcp \u00b7 via HTTP:4913 \u00b7 (sonde \/ probe)",
    "target_port_label": "4913 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_4913_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_4913_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4913,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 4913,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 4913 tcp \u00b7 via HTTP:4913 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "4913 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4913"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4913"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.757377871399937,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "HK",
    "dst_port": 4913,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "972aa4cdaaa46f2d1ae274a582fe9d145ba1a133",
    "event_fingerprint": "0eadcab09b89f71e5db852df2f4ee5c9a07552b8",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "46d07c8fb14e13c862914a071cdfcf1d",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 4913,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd\ufffdy\r\ufffd\ufffd\u001a\u0015MB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffd\br\ufffdI\ufffdC\u001a\ufffd61\ufffd\ufffd\ufffd\t\u001d\ufffd\u13ab\ufffd\u0004GZ\u001d\u0002\ufffdj\ufffd)w\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd\ufffdy\r\ufffd\ufffd\u001a\u0015MB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffd\br\ufffdI\ufffdC\u001a\ufffd61\ufffd\ufffd\ufffd\t\u001d\ufffd\u13ab\ufffd\u0004GZ\u001d\u0002\ufffdj\ufffd)w\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdx\u0016\ufffdV\ufffd\ufffdB\ufffd\ufffdOC\ufffd\ufffdr0i=\ufffd\u001c\u059e@\ufffd\u0004\u0019o\ufffd\ufffd\"",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd\ufffdy\r\ufffd\ufffd\u001a\u0015MB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffd\br\ufffdI\ufffdC\u001a\ufffd61\ufffd\ufffd\ufffd\t\u001d\ufffd\u13ab\ufffd\u0004GZ\u001d\u0002\ufffdj\ufffd)w\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3e701c41e4c8c22236dcc5250e57ef0c430adba7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd\ufffdy\r\ufffd\ufffd\u001a\u0015MB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffd\br\ufffdI\ufffdC\u001a\ufffd61\ufffd\ufffd\ufffd\t\u001d\ufffd\u13ab\ufffd\u0004GZ\u001d\u0002\ufffdj\ufffd)w\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 4913,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdy\r\ufffd\ufffdMB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffdr\ufffdI\ufffdC\ufffd61\ufffd\ufffd\ufffd\t\ufffd\u13ab\ufffdGZ\ufffdj\ufffd)w&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:4913 \u00b7 (sonde \/ probe)",
    "target_port_label": "4913 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 4913,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\ufffd\ufffdy\r\ufffd\ufffd\u001a\u0015MB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffd\br\ufffdI\ufffdC\u001a\ufffd61\ufffd\ufffd\ufffd\t\u001d\ufffd\u13ab\ufffd\u0004GZ\u001d\u0002\ufffdj\ufffd)w\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 4913,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:4913 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdy\r\ufffd\ufffdMB\ufffd\ufffdtb\ufffdV\ufffd\ufffd\ucd57\ufffdI\u06c9\ufffd\u0118 \ufffd\ufffdr\ufffdI\ufffdC\ufffd61\ufffd\ufffd\ufffd\t\ufffd\u13ab\ufffdGZ\ufffdj\ufffd)w&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "4913 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "4913"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:4913",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "HK",
    "dst_port": 4913,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4546758b5f882322634a53817068a1298abf4d80",
    "event_fingerprint": "a1ba0e80f1129f72c5d5ba588fc65be582ee0dc6",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 4913,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a0448ab833442d9a4fc0e96c2c8da03cbbcd1fc5",
    "protocol_details": {
        "port": 4913
    },
    "attack_vector": "Sonde port \u00b7 port 4913 \u00b7 (sonde \/ probe)",
    "target_port_label": "4913",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4913,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 4913
        },
        "attack_vector": "Sonde port \u00b7 port 4913 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4913",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4913"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d0c43d4d1da6f414033a36dd19a1ec314054009d",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.988387464037254,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 5398,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "9b8265486359fca764a1b26cf1858811dd021175",
    "event_fingerprint": "45499f9e60a86b84db01efe2f3df859e9904d1a1",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "c2fd2547e55420e945e4913bedc68b0e",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 5398,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bdb728e8325a3d0f48818e590c451a9049329265",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5398,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "5398 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5398,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5398,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5398 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5398"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d0c43d4d1da6f414033a36dd19a1ec314054009d",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.929315437363456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 5398,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "9b8265486359fca764a1b26cf1858811dd021175",
    "event_fingerprint": "eee8d04aea71ac3b5ac7a78491e99f765b0601fe",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "ff92d4e712d20c09629e31af91347d80",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 5398,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a43bfc2022303b43726e5b2505553076048badaa",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5398,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "5398 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5398,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5398,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5398 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5398"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "e001ac5eb25d00ba5b179c15ba13afc1a92a99c5",
    "http_host_hash": "d0c43d4d1da6f414033a36dd19a1ec314054009d",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 209,
    "payload_entropy": 5.4516649851692796,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 5398,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c7a093723d95d051f3f3ce7a892befcf03cf4880",
    "event_fingerprint": "139a7992cf04ba95cb2ef42ad344eacd92e77c61",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 44
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c7b05fa10f02f6897c5454702f42ed40",
        "payload_hash": "4d03cdc0ab768d8bd5e65d74614d02a6",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5398,
        "service": "http",
        "service_name": "http",
        "risk_score": 44
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Ge",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Ge",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Ge",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a31ec5760ed524302457ff3306da2dd57d2fb44c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36",
        "port": 5398,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Ge",
    "attack_vector": "exploit attempt \u00b7 via HTTP:5398 \u00b7 (tentative d'exploit)",
    "target_port_label": "5398 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5398,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Gecko) Chrome\/59.0.2471 Safari\/537.36",
            "port": 5398,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:5398 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_1_1; Win64; x64) AppleWebKit\/577.48 (KHTML, like Ge",
        "target_port_label": "5398 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5398"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d0c43d4d1da6f414033a36dd19a1ec314054009d",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.9447861737727825,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 5398,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "9b8265486359fca764a1b26cf1858811dd021175",
    "event_fingerprint": "e80952e721204e02e9f341587d70a35f7a8a3d60",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "57ebb45873f3b44c95e0e99c0196a2a3",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 5398,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9918d95c8772170029265fff82174c0080f21740",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5398,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "5398 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5398,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5398,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5398 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5398\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5398 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5398"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "e7bf35b13405f47bc2f4a9d37a174e67bbbbd1b6",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.959739523763947,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 2319,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c33872859114c8911c575a81bf7340ecf3eba85e",
    "event_fingerprint": "1a7e578993aaac6aedc7d2dc601970cba8144507",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "8edbe90de1e80a3d27cce54e8f977f90",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 2319,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3aec30a01578a59f7109508c697ef2970907baa5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2319,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "2319 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2319,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2319,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2319 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2319"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "e7bf35b13405f47bc2f4a9d37a174e67bbbbd1b6",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.900438313567961,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 2319,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c33872859114c8911c575a81bf7340ecf3eba85e",
    "event_fingerprint": "036a7bb4bbc8c71bb7d22bebc7deac221077d4fc",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "7e70c720818a8bb58cd4e51cf864c603",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 2319,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c7cb181562e92bdef7d5d281fed09c543217f1e0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2319,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "2319 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2319,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2319,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2319 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2319"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "1ac92f7e8673e79fc904c5e427da50f4c14b15ce",
    "http_host_hash": "e7bf35b13405f47bc2f4a9d37a174e67bbbbd1b6",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 208,
    "payload_entropy": 5.447145539283584,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 2319,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a61deaa1302e8342fc5f501681f29d4b8b5a0d69",
    "event_fingerprint": "7937cde92cb036c4e1952e2527e7843c4bd287c4",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 47
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f07dc236efb3c145b7b6bc5f1ddb37ad",
        "payload_hash": "40395250934231897f2f01823da51bdf",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2319,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Ge",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Ge",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Ge",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3ca97d278d15b26bd8815224cba4ea3837f657ad",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36",
        "port": 2319,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Ge",
    "attack_vector": "exploit attempt \u00b7 via HTTP:2319 \u00b7 (tentative d'exploit)",
    "target_port_label": "2319 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 47
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2319,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Gecko) Chrome\/91.0.427 Safari\/537.36",
            "port": 2319,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:2319 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit\/581.46 (KHTML, like Ge",
        "target_port_label": "2319 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2319"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "e7bf35b13405f47bc2f4a9d37a174e67bbbbd1b6",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.916138233499475,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 2319,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c33872859114c8911c575a81bf7340ecf3eba85e",
    "event_fingerprint": "851ca0f2011452d329094aa3d4224c793f9368d7",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "a9269eb27ef24bef43c7edea4db7b855",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 2319,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7ac0b2fc1f1fb52d9709f433125394d21328bb05",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2319,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "2319 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2319,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2319,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2319 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2319\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2319 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2319"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "bd5feb17f71ce802cc9860c12363e55d5ef09825",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.926020078720399,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 1280,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8cbee747c60d50f11a5fc436b46c0e4e757314f9",
    "event_fingerprint": "bdf49b569e01a83d689844fde7fbfea9b6192f67",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "f325d9e8bfba1c8d162463489fb18afa",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 1280,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3d51a1e984dd81e20462a8401ce9f51007e28b82",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 1280,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "1280 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1280,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 1280,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "1280 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1280"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "bd5feb17f71ce802cc9860c12363e55d5ef09825",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.910399213550653,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 1280,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8cbee747c60d50f11a5fc436b46c0e4e757314f9",
    "event_fingerprint": "0976d94d1bcc5c232c06db95d74b4c7751099d01",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "976dede364a1d8c8d0539a5c78314ea0",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 1280,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "12f0284cef2e39da16efaa5db9c4daf81cc6c4bd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 1280,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "1280 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1280,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 1280,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "1280 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1280"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "bd5feb17f71ce802cc9860c12363e55d5ef09825",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.969621368984871,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 1280,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8cbee747c60d50f11a5fc436b46c0e4e757314f9",
    "event_fingerprint": "0398b1797a8cd8a854d7190d76247153fd153b5e",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "f4e7f7a16f9f8cf003dd76838604e1af",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 1280,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6e8e8d4420b95c7d81624caaa99c951a6aff3c0b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 1280,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "1280 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1280,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 1280,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:1280 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "1280 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1280"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "ccc096ff6b1dc88565131aff8ce723981703e578",
    "http_host_hash": "bd5feb17f71ce802cc9860c12363e55d5ef09825",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.421320025403826,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 1280,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "62b4dac45c994a12ec4aff9f8ce03910dd482fbd",
    "event_fingerprint": "00a08ebd7844c4871f2e12fe2d78df96224a8271",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 44
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "433997fa53dba3ddaa5f241f1b799e2c",
        "payload_hash": "320d28bfd12badfe490904ff712af6d8",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1280,
        "service": "http",
        "service_name": "http",
        "risk_score": 44
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6164e498c133c4b983532ce53c507f2ddacc0262",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36",
        "port": 1280,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome",
    "attack_vector": "exploit attempt \u00b7 via HTTP:1280 \u00b7 (tentative d'exploit)",
    "target_port_label": "1280 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1280,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome\/95.0.1316 Safari\/537.36",
            "port": 1280,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:1280 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1280\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/550.46 (KHTML, like Gecko) Chrome",
        "target_port_label": "1280 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1280"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "10d1351dbf8b3d1d112a1cbc621732416c6ba639",
    "http_host_hash": "2e065037efe2c0713e3217cd8f5d8f1243238d1c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 207,
    "payload_entropy": 5.413350927976771,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 3354,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "45cd339999505ff039fc379f5811f9604634d3c9",
    "event_fingerprint": "71983abd9808cc5c256ad6562d837c8aa8b73e9d",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 44
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7d315aeaff128e08e3f123a9e0882888",
        "payload_hash": "1e0f1d73530e6b06245c185516006620",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 3354,
        "service": "http",
        "service_name": "http",
        "risk_score": 44
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Geck",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Geck",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Geck",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "058509a18dfd176306669ba3f5b11ba376e9d7bb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36",
        "port": 3354,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Geck",
    "attack_vector": "exploit attempt \u00b7 via HTTP:3354 \u00b7 (tentative d'exploit)",
    "target_port_label": "3354 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3354,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Gecko) Chrome\/97.0.2211 Safari\/537.36",
            "port": 3354,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:3354 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/579.55 (KHTML, like Geck",
        "target_port_label": "3354 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3354"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "2e065037efe2c0713e3217cd8f5d8f1243238d1c",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.916138233499475,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 3354,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "30eb5351d5bde32e2f5e68abb4351e01a5069693",
    "event_fingerprint": "8a8b62c107df545389a522bc0a08c948acba18c4",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "9070be0a8b20cf0a867722b36af56b0f",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 3354,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa0a7825d8f4d42a71c4c8fef299a30f3271fb20",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 3354,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:3354 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "3354 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3354,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 3354,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:3354 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "3354 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3354"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "2e065037efe2c0713e3217cd8f5d8f1243238d1c",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.959739523763947,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "HK",
    "dst_port": 3354,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "30eb5351d5bde32e2f5e68abb4351e01a5069693",
    "event_fingerprint": "65c6e2e30bb2c3d6ea5c285c9f81b9198d29442c",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "HK",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "18f566990bdf9f7322fb2cb0914c53ee",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 3354,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "533c211f7af850a89dbf791fc714620d934fda92",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 3354,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:3354 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "3354 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3354,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 3354,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:3354 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3354\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "3354 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3354"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}