152.32.182.165

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.7680858085123825,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "US",
    "dst_port": 2390,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "258254da6b4d5928b810c6ca4b626d96c3428561",
    "event_fingerprint": "a69dbfdc1735b4a62656037247035553a07e1df5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "823c62dc93193ad66d313f0e82d42524",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 2390,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z,7\u0014y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\u001f\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd\f:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\u0005\ufffd\ufffd]\ufffdS\ufffd\u0014\u02af\ufffd\u0015i\ufffd\ufffdi\ufffd+\/\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z,7\u0014y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\u001f\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd\f:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\u0005\ufffd\ufffd]\ufffdS\ufffd\u0014\u02af\ufffd\u0015i\ufffd\ufffdi\ufffd+\/\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0013\ufffdK\ufffd\/\ufffdzx5\ufffd%\u0256\u0001u\u0012)Rt\ufffd\u001f\ufffd\ufffd\ufffd4UyK\ufffd$\u000b",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z,7\u0014y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\u001f\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd\f:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\u0005\ufffd\ufffd]\ufffdS\ufffd\u0014\u02af\ufffd\u0015i\ufffd\ufffdi\ufffd+\/\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1eb207d2fe7e001c3b011f7f359eec46e0782ab1",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z,7\u0014y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\u001f\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd\f:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\u0005\ufffd\ufffd]\ufffdS\ufffd\u0014\u02af\ufffd\u0015i\ufffd\ufffdi\ufffd+\/\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 2390,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdz,7y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\ufffd\ufffd]\ufffdS\ufffd\u02af\ufffdi\ufffd\ufffdi\ufffd+\/\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:2390 \u00b7 (sonde \/ probe)",
    "target_port_label": "2390 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 2390,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z,7\u0014y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\u001f\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd\f:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\u0005\ufffd\ufffd]\ufffdS\ufffd\u0014\u02af\ufffd\u0015i\ufffd\ufffdi\ufffd+\/\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 2390,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:2390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdz,7y\ufffd\ufffdf\ufffdL\ufffd\ufffd'\ufffd\ufffd\"^\u5ee4j\ufffdSJ\ufffd\ufffd:9\ufffd\ufffd \ufffd\ufffd\ufffdVqF\ufffd\ufffd\ufffddb\ufffd\ufffd]\ufffdS\ufffd\u02af\ufffdi\ufffd\ufffdi\ufffd+\/\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "2390 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "2390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2390",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "US",
    "dst_port": 2390,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0ae2461eb0abdea191583735121ce8dd4809b9cf",
    "event_fingerprint": "8e3f0c4a10261cbc8275c216bb7c00788b7cf434",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2390,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8ccd465d498a3e605513520aeafee157eeacfe7d",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 2390
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 2390 \u00b7 (sonde \/ probe)",
    "target_port_label": "2390",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2390,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 2390
        },
        "attack_vector": "Sonde port \u00b7 port 2390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "2390",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2390",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "US",
    "dst_port": 2390,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "0e1146c487c45aa88c57b98b30e234c7415a0112",
    "event_fingerprint": "3dd3880f33043ab279ff5016daca0d06b620b8c9",
    "classification_reason": "Type \u00ab port_2390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2390,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_2390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "091eb059a17e9b7c8a7c2986e0d5d82a54227b71",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 2390,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 2390 tcp \u00b7 via HTTP:2390 \u00b7 (sonde \/ probe)",
    "target_port_label": "2390 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_2390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_2390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2390,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 2390,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 2390 tcp \u00b7 via HTTP:2390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "2390 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:2390"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "US",
    "dst_port": 2390,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0ae2461eb0abdea191583735121ce8dd4809b9cf",
    "event_fingerprint": "8e3f0c4a10261cbc8275c216bb7c00788b7cf434",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2390,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2cb46dd568d739c891f37fd234b3f0e1f7f64194",
    "protocol_details": {
        "port": 2390
    },
    "attack_vector": "Sonde port \u00b7 port 2390 \u00b7 (sonde \/ probe)",
    "target_port_label": "2390",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2390,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 2390
        },
        "attack_vector": "Sonde port \u00b7 port 2390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2390",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 31,
    "payload_entropy": 3.3729205036561045,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2ab0510cc4156c41c24112bc2a720db2",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
    "request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
    "payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
    "evidence": {
        "request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
        "payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "10d594edb0ce90fdd47ba5af36c0a435b2c9f917",
    "protocol_details": {
        "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 18,
    "payload_entropy": 3.4193819456463714,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 49,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "a965c8df31bc7ab99b7d5aefa1749e197f085794",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 97%",
    "confidence": 0.97,
    "classification_confidence": 0.97,
    "precision_score": 110,
    "precision_signals": [
        "pat-0373",
        "pat-0615"
    ],
    "kb_rule_ids": [
        "pat-0373",
        "pat-0615"
    ],
    "matched_patterns": [
        "pat-0373",
        "pat-0448",
        "pat-0543",
        "pat-0615",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "MQTT protocol",
        "UA nmap",
        "Sigma nmap UA",
        "MQTT alt CONNECT",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0373",
        "pat-0448",
        "pat-0543",
        "pat-0615",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 49
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad60b419f2f0103bea99389955f5bdf8",
        "path_pattern_hash": "4449b927317468afa12a2f935a413459"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 49
    },
    "payload_preview": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
    "request_sample": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
    "payload_snippet": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
    "evidence": {
        "request_sample": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
        "payload_snippet": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 97%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fcb67a3cdeb07f346f47611671cdfa8b9ad1d5b4",
    "protocol_details": {
        "payload_preview": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "MQTTnmap",
    "attack_vector": "mqtt probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 97%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100",
        "confidence_pct": 97,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 49
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 49,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0373",
            "pat-0615"
        ],
        "tags_summary_labels_fr": [
            "pat-0373",
            "pat-0615"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0010\u0010\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\u0004nmap",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "mqtt probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "MQTTnmap",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mqtt_connect",
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 48,
    "payload_entropy": 2.5723387961875535,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0605"
    ],
    "kb_rule_ids": [
        "pat-0605"
    ],
    "matched_patterns": [
        "pat-0605",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "GIOP WebSphere IIOP",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0605",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2295e3d24182f08220a2dae2c40ff1c",
        "path_pattern_hash": "a8ef247ba3612b90c1c670387b185e85"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 45
    },
    "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan",
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "edf4e8b0eeea31ef4e5931a3218fc5e0e7c12352",
    "protocol_details": {
        "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "GIOP$abcdefget",
    "attack_vector": "websphere probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0605"
        ],
        "tags_summary_labels_fr": [
            "pat-0605"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "websphere probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GIOP$abcdefget",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 2,
    "payload_entropy": 1,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4b24f4cca7e61459da3fb7bee3042b66",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 24
    },
    "payload_preview": "\ufffd\u0001",
    "request_sample": "\ufffd\u0001",
    "payload_snippet": "\ufffd\u0001",
    "evidence": {
        "request_sample": "\ufffd\u0001",
        "payload_snippet": "\ufffd\u0001",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ac03ec81c6208f21aa86ec37af79592ceb9d6b0c",
    "protocol_details": {
        "payload_preview": "\ufffd\u0001",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\ufffd\u0001",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0411"
    ],
    "matched_pattern_names": [
        "Redis INFO"
    ],
    "pattern_ids": [
        "pat-0411"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4f9ff4b8ec8624803229b3cea88426af",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 24
    },
    "payload_preview": "*1\r\n$4\r\ninfo\r\n",
    "request_sample": "*1\r\n$4\r\ninfo\r\n",
    "payload_snippet": "*1\r\n$4\r\ninfo",
    "evidence": {
        "request_sample": "*1\r\n$4\r\ninfo\r\n",
        "payload_snippet": "*1\r\n$4\r\ninfo",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6eb4bb4376ca6f0cced7df4f27ef9b8129e9de0",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\ninfo",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "*1\r\n$4\r\ninfo",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\ninfo",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\ninfo",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 65,
    "payload_entropy": 3.3778795428324466,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0356"
    ],
    "kb_rule_ids": [
        "pat-0356"
    ],
    "matched_patterns": [
        "pat-0356",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0356",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bf7469d78bb1798d5188209f4494c1a3",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 32
    },
    "payload_preview": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
    "request_sample": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
    "payload_snippet": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
    "evidence": {
        "request_sample": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
        "payload_snippet": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "54c40d73a081ad3bbd86ca13590a946d777e60fa",
    "protocol_details": {
        "payload_preview": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "A:0\ufffd\ufffd\ufffd\ufffd\ufffdtest.$cmd\ufffd\ufffd\ufffd\ufffdserverStatus\ufffd?",
    "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0356"
        ],
        "tags_summary_labels_fr": [
            "pat-0356"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "A\u0000\u0000\u0000:0\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd?\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "A:0\ufffd\ufffd\ufffd\ufffd\ufffdtest.$cmd\ufffd\ufffd\ufffd\ufffdserverStatus\ufffd?",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 18,
    "payload_entropy": 1.2086489509530647,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0532"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "817773a4a3987fc7642ff30928d792fc",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e116a8a1e522b21bde23ff80541d60a4d170aac2",
    "protocol_details": {
        "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0532"
        ],
        "tags_summary_labels_fr": [
            "pat-0532"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 450,
    "payload_entropy": 1.82286057779224,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "5470445960e07da06a81b48f97f230f1b122993f",
    "event_fingerprint": "71c9faca89e58b867be02892c69164e15314f293",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0532",
        "pat-0577",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "NFS RPC mount",
        "RADIUS Access-Request",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0532",
        "pat-0577",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "sap-diag",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eceedace3cdd6b7c3a4b6f3b21c20f1b",
        "path_pattern_hash": "b2b7054d4e93545579234509accfce08"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 42
    },
    "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0001\u0000\u0000SQLDB2RA\u0000\u0001\u0000\u0000\u0004\u0001\u0001\u0000\u0005\u0000\u001d\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000@\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001",
    "evidence": {
        "request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0001\u0000\u0000SQLDB2RA\u0000\u0001\u0000\u0000\u0004\u0001\u0001\u0000\u0005\u0000\u001d\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000@\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0002\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0003\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0010\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\u0010\u0000\u0000\u0000\u0001\u0000\u0000\ufffd",
        "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0001\u0000\u0000SQLDB2RA\u0000\u0001\u0000\u0000\u0004\u0001\u0001\u0000\u0005\u0000\u001d\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000@\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "26076878bdbe0ed86912b42bba30b670d1c7577f",
    "protocol_details": {
        "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0001\u0000\u0000SQLDB2RA\u0000\u0001\u0000\u0000\u0004\u0001\u0001\u0000\u0005\u0000\u001d\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000@\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffdSQLDB2RA\ufffd\ufffd\t@\t@@@@@@@",
    "attack_vector": "port 3286 tcp \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\ufffd\u0001\u0000\u0000SQLDB2RA\u0000\u0001\u0000\u0000\u0004\u0001\u0001\u0000\u0005\u0000\u001d\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\t\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000\u0001\b\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0000\u0000@\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001\u0004\u0000\u0000\u0000\u0004\u0000\u0000@\u0000\u0000\u0000\u0001",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "port 3286 tcp \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdSQLDB2RA\ufffd\ufffd\t@\t@@@@@@@",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "db2_probe",
        "net_db2_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 7,
    "payload_entropy": 2.2359263506290326,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 164,
    "precision_signals": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "kb_rule_ids": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "matched_patterns": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "matched_pattern_names": [
        "Memcached stats",
        "Memcached stats",
        "ET Memcached UDP"
    ],
    "pattern_ids": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "11e629574907d3a9ced402e26f4a98df",
        "path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 50
    },
    "payload_preview": "stats\r\n",
    "request_sample": "stats\r\n",
    "payload_snippet": "stats",
    "evidence": {
        "request_sample": "stats\r\n",
        "payload_snippet": "stats",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed3d2936b7015bad1784f65863f76f69fb0fc538",
    "protocol_details": {
        "payload_preview": "stats",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "stats",
    "attack_vector": "memcached probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via SAP Diag",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0374",
            "pat-0533",
            "pat-0865"
        ],
        "tags_summary_labels_fr": [
            "pat-0374",
            "pat-0533",
            "pat-0865"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "stats",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "memcached probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "stats",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 52,
    "payload_entropy": 3.604409845438833,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 35,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "c50d570e09f32596fb09f0c8738ce86dff99c212",
    "event_fingerprint": "1cdb3ec303491944150ab3f9f838a2a574248d32",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "23edc99bdfe5fe902f5ff28aa98ef130",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "285ae0527d8191bbf35e485d30354c8de6077654",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "4(\ufffdUMSSQLServerH",
    "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "4(\ufffdUMSSQLServerH",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 13,
    "payload_entropy": 2.7773627950641693,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 35,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "d8bef8b46a333d623731db6c2777d3b1321d24ae",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2167ce4c1a0201b2283cc57c40a74bac",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
    "request_sample": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
    "payload_snippet": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
        "payload_snippet": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "97e7605ec3500a9d50990f24cb213f2c7e65414c",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "root",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000\u0016\u0000\u0000\u0001root\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "root",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe",
        "socks4_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 41,
    "payload_entropy": 4.503416638553355,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0567"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d345b721f5d98a2b04db9dadef49f152",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0\r\n\r\n",
    "request_sample": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0\r\n\r\n",
    "payload_snippet": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0",
    "evidence": {
        "request_sample": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0\r\n\r\n",
        "payload_snippet": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "008d6ab9c47e94b7a32282e8d91d4d28f7953bcd",
    "protocol_details": {
        "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ngoogle.comPGET \/ HTTP\/1.0",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0567"
        ],
        "tags_summary_labels_fr": [
            "pat-0567"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET \/ HTTP\/1.0",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ngoogle.comPGET \/ HTTP\/1.0",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 90,
    "payload_entropy": 3.5636982611044665,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ee3f9a4a2b04c32e4d515a179936da49",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "evidence": {
        "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "780e3cddcc6fa90a30d1364486e3562b4944d5f3",
    "protocol_details": {
        "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "Z6,\ufffd :4\ufffd(CONNECT_DATA=(COMMAND=version))",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Z6,\ufffd :4\ufffd(CONNECT_DATA=(COMMAND=version))",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 175,
    "payload_entropy": 3.1019691748828695,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0577",
        "pat-0554",
        "pat-0536",
        "pat-0623"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "RADIUS Access-Request",
        "Minecraft varint handshake",
        "TFTP RRQ",
        "WireGuard handshake"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0577",
        "pat-0554",
        "pat-0536",
        "pat-0623"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f884620dcffbd325c528857bf10be8ac",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 32
    },
    "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u00000\u0000.\u00000\u0000.\u00002\u00009\u00008\u00000\u0000;\u0000 \u0000{\u00000\u00000\u00000\u00000\u0000A\u0000A\u00000\u00000\u0000-\u00000\u0000A\u00000\u00000\u0000-\u00000\u00000\u0000a",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u00000\u0000.\u00000\u0000.\u00002\u00009\u00008\u00000\u0000;\u0000 \u0000{\u00000\u00000\u00000\u00000\u0000A\u0000A\u00000\u00000\u0000-\u00000\u0000A\u00000\u00000\u0000-\u00000\u00000\u0000a\u00000\u0000-\u0000A\u0000A\u00000\u0000A\u0000-\u00000\u00000\u00000\u00000\u0000A\u00000\u0000A\u0000A\u00000\u0000A\u0000A\u00000\u0000}\u0000\u0000\u0000\ufffdm\ufffd_",
        "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u00000\u0000.\u00000\u0000.\u00002\u00009\u00008\u00000\u0000;\u0000 \u0000{\u00000\u00000\u00000\u00000\u0000A\u0000A\u00000\u00000\u0000-\u00000\u0000A\u00000\u00000\u0000-\u00000\u00000\u0000a",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a83201b496fb4259e747ea35e35df8ffbd069c59",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u00000\u0000.\u00000\u0000.\u00002\u00009\u00008\u00000\u0000;\u0000 \u0000{\u00000\u00000\u00000\u00000\u0000A\u0000A\u00000\u00000\u0000-\u00000\u0000A\u00000\u00000\u0000-\u00000\u00000\u0000a",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9.0.0.2980; {0000AA00-0A00-00a",
    "attack_vector": "kafka probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u00000\u0000.\u00000\u0000.\u00002\u00009\u00008\u00000\u0000;\u0000 \u0000{\u00000\u00000\u00000\u00000\u0000A\u0000A\u00000\u00000\u0000-\u00000\u0000A\u00000\u00000\u0000-\u00000\u00000\u0000a",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "kafka probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9.0.0.2980; {0000AA00-0A00-00a",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 2,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 7,
    "payload_entropy": 2.807354922057604,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0604"
    ],
    "kb_rule_ids": [
        "pat-0604"
    ],
    "matched_patterns": [
        "pat-0604"
    ],
    "matched_pattern_names": [
        "Java RMI JRMI"
    ],
    "pattern_ids": [
        "pat-0604"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d8c49a0f759e2102fb8fa8368049d06a",
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 32
    },
    "payload_preview": "JRMI\u0000\u0002K",
    "request_sample": "JRMI\u0000\u0002K",
    "payload_snippet": "JRMI\u0000\u0002K",
    "evidence": {
        "request_sample": "JRMI\u0000\u0002K",
        "payload_snippet": "JRMI\u0000\u0002K",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "47ba77380fe342a62aab626ab303d155dde7c705",
    "protocol_details": {
        "payload_preview": "JRMI\u0000\u0002K",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "JRMIK",
    "attack_vector": "java rmi probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0604"
        ],
        "tags_summary_labels_fr": [
            "pat-0604"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "JRMI\u0000\u0002K",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "java rmi probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "JRMIK",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 60,
    "payload_entropy": 1.3389205950315934,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 33,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "7eae3c819fb0fba36bd4adbeadfc2a2082544f24",
    "event_fingerprint": "e897fc5ef9bbdfe785f613c22fe003a2eec492ed",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 80%",
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "precision_score": 90,
    "precision_signals": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0532",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "NFS RPC mount",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0532",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "classification_parent": "mongodb_probe",
    "service_name": "sap-diag",
    "risk_confidence_factor": 80,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f60433e5ca098d6d06ab4b829e9f35c4",
        "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 33
    },
    "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 80%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ab38842cb3097d685387358aac4aa50a2fba79ec",
    "protocol_details": {
        "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": ":\/@=\/@",
    "attack_vector": "mongodb wire protocol \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 80 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 80%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 80%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 80,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "ET-PROTO-MongoDB-Wire",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "ET-PROTO-MongoDB-Wire",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "mongodb wire protocol \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": ":\/@=\/@",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 80 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mongodb_wire_protocol",
        "net_mongodb_wire_protocol",
        "rdp_cookie_alt",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 23,
    "payload_entropy": 2.6081816167087406,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "947f08e762562490af13d3254ff011a6",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "evidence": {
        "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6a6ce7c06bc3f8de1d5cb5e6c6023f3178dfc1c",
    "protocol_details": {
        "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "DmdT\ufffd\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "DmdT\ufffd\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 22,
    "payload_entropy": 3.133919825058653,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "S7 TPKT packet",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "sap-diag",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "097791b86f9950e021480f7ef5b4d939",
        "path_pattern_hash": "b2b7054d4e93545579234509accfce08"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001\n",
    "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001\n",
    "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001\n",
        "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0ffa9e094f6ebb10b3219284e1b05f91cb0250fa",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "port 3286 tcp \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0014\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0001\u0002\ufffd\u0001",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "port 3286 tcp \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 11,
    "payload_entropy": 2.4040097573248604,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "95bb1798cbe14e09d8a7b5feb33c741f",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "request_sample": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "payload_snippet": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "evidence": {
        "request_sample": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "payload_snippet": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7166b26e0f4c92d497a3ee70362cb74ca960e792",
    "protocol_details": {
        "payload_preview": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffdt+",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\ufffdt\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdt+",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 56,
    "payload_entropy": 3.7279714939527033,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fca620885715d4e346da0f82d84da595",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
    "request_sample": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
    "payload_snippet": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
        "payload_snippet": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a32c617a47fc8e62266dfaa88f687432a60407f",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "0.26.00.26.10202cb962ac59075b964b07152d234b70",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\u0006\u0000\u0000\u00000.26.0\u0007\u0000\u0000\u00000.26.10202cb962ac59075b964b07152d234b70",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "0.26.00.26.10202cb962ac59075b964b07152d234b70",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 49,
    "payload_entropy": 4.193778152167447,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 35,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "13559a74c2925a3ca143c2fec470ed03098c4654",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "493a3d213b080175a70a3be3bdf3d870",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
    "request_sample": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
    "payload_snippet": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
    "evidence": {
        "request_sample": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
        "payload_snippet": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2911bc183c073de59228ec1b2118dd69a122c548",
    "protocol_details": {
        "payload_preview": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "){\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": ")\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "){\"Type\":\"Auth\",\"Payload\":{\"Version\":\"2\"}}",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mongodb_version",
        "mongodb_version_2",
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 12,
    "payload_entropy": 0.8112781244591328,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "89fcddd8e965f8ff958358b927013df6",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "341f8a9f22c70034b81d62544f8a8a8af0ab8d58",
    "protocol_details": {
        "payload_preview": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 59,
    "payload_entropy": 3.860214023388077,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0626"
    ],
    "kb_rule_ids": [
        "pat-0626"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0626",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "OPC UA HEL",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0626",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "405e43878bd2caed9a786695e348bf9d",
        "path_pattern_hash": "9665a326f7d8f70f1661dab78807b951"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 40
    },
    "payload_preview": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
    "request_sample": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
    "payload_snippet": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
    "evidence": {
        "request_sample": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
        "payload_snippet": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c4af2ef21ff3fd21d3e2b416a61fe86ee0c32a83",
    "protocol_details": {
        "payload_preview": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "HELF;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdopc.tcp:\/\/85.214.126.3:4840",
    "attack_vector": "opcua probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0626"
        ],
        "tags_summary_labels_fr": [
            "pat-0626"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp:\/\/85.214.126.3:4840",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "opcua probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "HELF;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdopc.tcp:\/\/85.214.126.3:4840",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 16,
    "payload_entropy": 1.6216407621868583,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f49be22988ace8a28a7eea705f9e0c37",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
    "request_sample": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
    "payload_snippet": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
        "payload_snippet": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed70cd0713fa31dc79d2ec94d2dfda4e7f68293a",
    "protocol_details": {
        "payload_preview": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "G\ufffd\ufffd\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0010\u0000\u0000\u0000G\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\ufffd\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "G\ufffd\ufffd\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 113,
    "payload_entropy": 4.641748802606944,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "94179f64d7c7524a23b3cbf2af232c73",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
    "request_sample": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
    "payload_snippet": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
        "payload_snippet": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "db72d6f0c359e265f100853c8886ec3bf0adc4ca",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "mi{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000m\u0000\u0000\u0000i{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "mi{\"code\":105,\"language\":\"GO\",\"version\":317,\"opaque\":2,\"flag\":0,\"remark\":\"\",\"extFields\":{\"topic\":\"TBW102\"}}",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 131,
    "payload_entropy": 4.943692969509017,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7ac31581d9769a3294f2b8ec05c3e9e6",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006",
    "request_sample": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006\ufffd\u001b",
    "payload_snippet": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006",
    "evidence": {
        "request_sample": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006\ufffd\u001b",
        "payload_snippet": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ff3773bc61f2d6e8bb6f0cb744510ed869702436",
    "protocol_details": {
        "payload_preview": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "2W2Cwx^j\ufffd\ufffd2J`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}6",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000wx^\u0000j\u0000\ufffd\ufffd2J\u0000\u0000\u0000\u0001\u0000\u0000\u0000`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}\u0003\u00006",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "2W2Cwx^j\ufffd\ufffd2J`{\"@timestamp\":\"2023-11-10T16:31:19.3549634+08:00\",\"message\":\"t\",\"offset\":1000,\"type\":\"filebeat\"}6",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 29,
    "payload_entropy": 4.064203408622266,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a28a90b32f6006a6cfa98505ba373419",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
    "request_sample": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
    "payload_snippet": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
        "payload_snippet": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a0973b8e7ef133560bb52ed940317ac71405ec5",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "a\n4.6.2.3\"\t8798306680",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\u0019a\n\u00074.6.2.3\u0010\u0006\"\t8798306680\u0001",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "a\n4.6.2.3\"\t8798306680",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 93,
    "payload_entropy": 4.682586603096229,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4d682adf59b1d9e41be709f5ccbc8084",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n",
    "request_sample": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2f22289b31d5c082228113df99ca0d2fdff1950a",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd]I223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffd\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd]I223.75.123.71\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 32,
    "payload_entropy": 1.498778124459133,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "48d1c4bf25ef5b6ad32d76fb795398b9",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
    "request_sample": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
    "payload_snippet": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
        "payload_snippet": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6e00830a3446a098a30fac2f928aa10e392da0b4",
    "protocol_details": {
        "payload_preview": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd`\ufffd\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\ufffd\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000\ufffd\ufffd",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd`\ufffd\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 13,
    "payload_entropy": 3.3927474104487847,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b95100bea23f1bbc831cc0175ad22cfe",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 24
    },
    "payload_preview": "EXAMPLE.COM\r\n",
    "request_sample": "EXAMPLE.COM\r\n",
    "payload_snippet": "EXAMPLE.COM",
    "evidence": {
        "request_sample": "EXAMPLE.COM\r\n",
        "payload_snippet": "EXAMPLE.COM",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9880fa2c9c2e8d08b259cfdd3b82801efcea4d49",
    "protocol_details": {
        "payload_preview": "EXAMPLE.COM",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "EXAMPLE.COM",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "EXAMPLE.COM",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "EXAMPLE.COM",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 179,
    "payload_entropy": 5.098770336543975,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 25
    },
    "risk_score": 24,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "13c773fb9b5dbf600819e4250aaaff0216d3a691",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 25,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c500383ebccf2fc673ea77e9e47d6daf",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 24
    },
    "payload_preview": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
    "request_sample": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\":[\"cn\/1\"],\"algo-perf\":{\"cn\/1\":63.32038223248976}}}\n",
    "payload_snippet": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
    "evidence": {
        "request_sample": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\":[\"cn\/1\"],\"algo-perf\":{\"cn\/1\":63.32038223248976}}}\n",
        "payload_snippet": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2b41d98f011c646061a7d17b6284d8e5b42b4d81",
    "protocol_details": {
        "payload_preview": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 25,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"YOUR_WALLET_ADDRESS\",\"pass\":\"x\",\"agent\":\"XMRig\/6.20.0-C3Pool\",\"algo\"",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cryptominer_probe",
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe",
        "xmrig_pattern"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 14,
    "payload_entropy": 1.9502120649147467,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0368",
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0368",
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0368",
        "pat-0369",
        "pat-0556",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "PostgreSQL cancel request",
        "PostgreSQL startup",
        "Kafka ApiVersions key",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0368",
        "pat-0369",
        "pat-0556",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "19214bd9a0c01f9428154f3b658852b6",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
    "request_sample": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
    "payload_snippet": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
        "payload_snippet": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cc12ac5656e369a3c3352a538e50d931c2e2c574",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd",
    "attack_vector": "postgres probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0368",
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0368",
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\n\u0000\u0012\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "postgres probe \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 40,
    "payload_entropy": 3.2516094970590266,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ade4c3e7a4c503a0785a09ddcef1efb8",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af2cc0daa4d9488ec6e1cf57a28c7abcea2ff9ee",
    "protocol_details": {
        "payload_preview": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffdanonymous_command_on",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\ufffd\u0001\u0000\u0001\u0000\u0000\u0000\u0014anonymous_command_on\u0000\u0000\u0000\u0000\b\u0000\u0001\u0000\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdanonymous_command_on",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 39,
    "payload_entropy": 4.6632313853624945,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "268e50c3963f0c6fe6ca87afd0ce66b8",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
    "request_sample": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
    "payload_snippet": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
    "evidence": {
        "request_sample": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
        "payload_snippet": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af2a3941771b8a8548d5c7745d23990fb0e8be35",
    "protocol_details": {
        "payload_preview": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "#!:62710*\rfd135ge@&yt_02123456",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "#\u0000\u0000\u0000\u0012!\u0010\u0003\u001a\u0006:62710*\rfd135ge@&yt_02\u0006123456",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "#!:62710*\rfd135ge@&yt_02123456",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 43,
    "payload_entropy": 5.10068335935326,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f4f17bcdc73af477913b79f96989f7d8",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
    "request_sample": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
    "payload_snippet": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
    "evidence": {
        "request_sample": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
        "payload_snippet": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2ca8948e2ee8ff292395fdf54c68ab81a5926ae3",
    "protocol_details": {
        "payload_preview": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffdx#.\ufffd=\ufffd\ufffd\ufffd$\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdWE$e\ufffdV\ufffd>\\\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\ufffdx\u0017\u0001#\u0000\u0000\u0000.\ufffd=\b\ufffd\ufffd\ufffd$\u0000\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffdW\u001dE\u0005$e\ufffdV\ufffd>\\\ufffd",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdx#.\ufffd=\ufffd\ufffd\ufffd$\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdWE$e\ufffdV\ufffd>\\\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 156,
    "payload_entropy": 1.0056921668856296,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5ca0ed1490012fe941f931322c79c1f4",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ppap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ppap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ppap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b82b216d7f375aca7199b653ed295178e1a65f98",
    "protocol_details": {
        "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ppap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd+<M\ufffd\ufffdnoneppap",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ppap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd+<M\ufffd\ufffdnoneppap",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 144,
    "payload_entropy": 4.6684321087757565,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 39,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284",
        "pat-0103",
        "pat-0530"
    ],
    "matched_pattern_names": [
        "CRS 941130",
        "LFI Double-dot bypass",
        "XMPP stream"
    ],
    "pattern_ids": [
        "pat-0284",
        "pat-0103",
        "pat-0530"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 39
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2c2f7964ac7971e254cec36837483540",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 39
    },
    "payload_preview": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
    "request_sample": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.' version='1.0'>",
    "payload_snippet": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
    "evidence": {
        "request_sample": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.' version='1.0'>",
        "payload_snippet": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3c2711e0f958bd3b578bbb6485cb32f545512070",
    "protocol_details": {
        "payload_preview": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
    "attack_vector": "xss attack \u00b7 via SAP Diag:3286 \u00b7 (tentative d'exploit)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 59%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SAP Diag",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 39
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 39,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "xss attack \u00b7 via SAP Diag:3286 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "<?xml version='1.0'?><stream:stream xmlns:stream='http:\/\/etherx.jabber.org\/streams' xmlns='jabber:client' xml:lang='ru-RU' to='.",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 20,
    "payload_entropy": 2.1709505944546685,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10
    },
    "risk_score": 32,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "c50d570e09f32596fb09f0c8738ce86dff99c212",
    "event_fingerprint": "1cdb3ec303491944150ab3f9f838a2a574248d32",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 10,
        "risk_score": 32
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "78303524a43907117dd5e6de4f427da3",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 32
    },
    "payload_preview": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c45910b682f13fd78a7c29da9076cef5fe0c008",
    "protocol_details": {
        "payload_preview": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "index\ufffd",
    "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 10,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "mssql tds \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "index\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 118,
    "payload_entropy": 5.151202745659785,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 135377,
    "country": "US",
    "dst_port": 3286,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae92055dbfce114524959dcef6e63e5f3633d21a",
    "event_fingerprint": "1787eabbfcd7e74db7e25af4fd8862332942a907",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e4c389aa171b6c4fc8c08b745ec87f45",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3286,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_preview": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
    "request_sample": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
    "payload_snippet": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
        "payload_snippet": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfa047e9e3ddaff6ae9eb96fc142b66e60676519",
    "protocol_details": {
        "payload_preview": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
        "port": 3286,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffdJoin\u00e5Nodes\ufffdUserStateLen\ufffd\ufffdAddr\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffdIncarnation\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\n\ufffdState\ufffdVsn\ufffd",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
    "target_port_label": "3286 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3286,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0006\ufffd\ufffdJoin\u00e5Nodes\u0001\ufffdUserStateLen\u0000\ufffd\ufffdAddr\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd8\u0001\ufffdIncarnation\u0001\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\u001f\n\ufffdState\u0000\ufffdVsn\ufffd\u0001\u0005\u0002\u0000\u0000\u0000",
            "port": 3286,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3286 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdJoin\u00e5Nodes\ufffdUserStateLen\ufffd\ufffdAddr\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffdIncarnation\ufffdMeta\ufffd\ufffdName\ufffdDESKTOP-NR8TTVR\ufffdPort\ufffd\n\ufffdState\ufffdVsn\ufffd",
        "target_port_label": "3286 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3286"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ]
}