157.230.10.16

{
    "protocol_emulated": true,
    "emulator_response": "20020000",
    "emulator_response_len": 4,
    "bytes_in": 27,
    "payload_entropy": 4.106377316818027,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mqtts",
    "app_proto": "mqtts",
    "asn": 14061,
    "country": "US",
    "dst_port": 8883,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 10
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "3997edb3ca926fc3a3dd39c8da7598b3441177d3",
    "event_fingerprint": "5f7b059db7e7baf96b44a473308871c1ef92cf07",
    "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 135,
    "precision_signals": [
        "pat-0373",
        "pat-0615",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0373",
        "pat-0615",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0373",
        "pat-0615",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "MQTT protocol",
        "MQTT alt CONNECT",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0373",
        "pat-0615",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 10,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "mqtts",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2a9a1e3fac3651fb66db53dcba1012a",
        "path_pattern_hash": "4449b927317468afa12a2f935a413459"
    },
    "target_context": {
        "dst_port": 8883,
        "service": "mqtts",
        "service_name": "mqtts",
        "risk_score": 50
    },
    "payload_preview": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
    "request_sample": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
    "payload_snippet": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
    "evidence": {
        "request_sample": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
        "payload_snippet": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
        "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e455d971d07e782cfbb6bc0b7104a25de15d798e",
    "protocol_details": {
        "payload_preview": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
        "port": 8883,
        "service": "mqtts",
        "service_label_fr": "MQTTS"
    },
    "evidence_snippet": "MQTT\rtopic-monitor",
    "attack_vector": "mqtt probe \u00b7 via MQTTS:8883 \u00b7 (sonde \/ probe)",
    "target_port_label": "8883 \u00b7 MQTTS",
    "emulator_service": "mqtts",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTTS",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 10,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "mqtts",
        "service_label_fr": "MQTTS",
        "dst_port": 8883,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0373",
            "pat-0615",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0373",
            "pat-0615",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mqtts",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0010\u0019\u0000\u0004MQTT\u0004\u0002\u0000\u001e\u0000\rtopic-monitor",
            "port": 8883,
            "service": "mqtts",
            "service_label_fr": "MQTTS"
        },
        "attack_vector": "mqtt probe \u00b7 via MQTTS:8883 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "MQTT\rtopic-monitor",
        "target_port_label": "8883 \u00b7 MQTTS",
        "emulator_service": "mqtts",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mqtts",
        "service_banner": "honeypot-mqtts",
        "service_os": "linux",
        "dst_port": "8883"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "mqtt_connect",
        "mqtts_emulated",
        "mqtts_payload",
        "net_mqtt_probe",
        "tor_exit_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 297,
    "payload_entropy": 5.80511763985829,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch-node",
    "app_proto": "elasticsearch-node",
    "asn": 14061,
    "country": "US",
    "dst_port": 9201,
    "risk_waf": 8,
    "risk_classification": 24,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 24,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "44f8a41378d7b1db42f5c79bf49f0b3dee05270b",
    "event_fingerprint": "96caf61f0a06952376d9e3e740fce3c685611323",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab elasticsearch-node \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 24,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "service_name": "elasticsearch-node",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bcbb76f7b4d1dd8aca591f263c3e61b4",
        "path_pattern_hash": "f1d579ed48671b21faaf81406c9238b7"
    },
    "target_context": {
        "dst_port": 9201,
        "service": "elasticsearch-node",
        "service_name": "elasticsearch-node",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\u0006\ufffd1#\u057b0Y\ufffd\ufffdW\u0016\ufffd\ufffd\ufffd\u001d\ufffd\u0011<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\u0006\ufffd1#\u057b0Y\ufffd\ufffdW\u0016\ufffd\ufffd\ufffd\u001d\ufffd\u0011<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\u0006\ufffd1#\u057b0Y\ufffd\ufffdW\u0016\ufffd\ufffd\ufffd\u001d\ufffd\u0011<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "classification_reason": "Type \u00ab elasticsearch-node \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5d47adcfcf17c461bbafd52701fee3c5d148899a",
    "protocol_details": {
        "elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
        "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\u0006\ufffd1#\u057b0Y\ufffd\ufffdW\u0016\ufffd\ufffd\ufffd\u001d\ufffd\u0011<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "port": 9201,
        "service": "elasticsearch-node",
        "service_label_fr": "ELASTICSEARCH NODE"
    },
    "evidence_snippet": "$ \ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\ufffd1#\u057b0Y\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
    "attack_vector": "elasticsearch-node \u00b7 via ELASTICSEARCH NODE:9201 \u00b7 (sonde \/ probe)",
    "target_port_label": "9201 \u00b7 ELASTICSEARCH NODE",
    "emulator_service": "elasticsearch-node",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab elasticsearch-node \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab elasticsearch-node \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 24,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "elasticsearch-node",
        "service_label_fr": "ELASTICSEARCH NODE",
        "dst_port": 9201,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-elasticsearch-node",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
            "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\u0006\ufffd1#\u057b0Y\ufffd\ufffdW\u0016\ufffd\ufffd\ufffd\u001d\ufffd\u0011<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
            "port": 9201,
            "service": "elasticsearch-node",
            "service_label_fr": "ELASTICSEARCH NODE"
        },
        "attack_vector": "elasticsearch-node \u00b7 via ELASTICSEARCH NODE:9201 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "$ \ufffd\ufffdCe\ufffd\u033b\ufffd\ufffd:\u02ffde\u026e\ufffd_;\ufffda\ufffd2\u0221z\ufffd\ufffd\ufffd\u02f3\ufffd \ufffd\ufffd\ufffd1#\u057b0Y\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd<)\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\\\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
        "target_port_label": "9201 \u00b7 ELASTICSEARCH NODE",
        "emulator_service": "elasticsearch-node",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch_node",
        "service_banner": "honeypot-elasticsearch-node",
        "service_os": "linux",
        "dst_port": "9201"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "elasticsearch-node",
        "http"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "664e3a87c18b188d04fa05f633a3d5a70083f680",
    "http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 103,
    "payload_entropy": 4.929626082593233,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 9201,
    "risk_waf": 64,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 53,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "78066369be3b12b88187abbe6b5aca12dd631510",
    "event_fingerprint": "cdfef35dbfc89eca7545c7ccbe565c1e63fab952",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 53
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "aaca2bd1ea79943eee5cfb17ab27a904",
        "path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
    },
    "target_context": {
        "dst_port": 9201,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/v2\/_catalog",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950316:lfi-14",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "nosqli-3"
    ],
    "request_line": "GET \/v2\/_catalog HTTP\/1.1",
    "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/v2\/_catalog",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950316:lfi-14",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "nosqli-3"
        ],
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "709b29bf6ec84b79cdf391bcbfc66d9a7d1457e3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v2\/_catalog",
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/v2\/_catalog",
        "port": 9201,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:9201 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
    "target_port_label": "9201 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 78,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 53
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9201,
        "protocol_emulated": true,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v2\/_catalog",
            "request_line": "GET \/v2\/_catalog HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/v2\/_catalog",
            "port": 9201,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:9201 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
        "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9201\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9201 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9201"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950468:nosqli-3",
        "http_probe_registry",
        "http_ua_suspicious",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 131,
    "payload_entropy": 5.08345697996659,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb",
    "app_proto": "mongodb",
    "asn": 14061,
    "country": "US",
    "dst_port": 27017,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 33,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "003aa01523cfd5b494271e1e92efb43a3f4a8c5d",
    "event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
    "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "precision_score": 90,
    "precision_signals": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "classification_parent": "mongodb_probe",
    "service_name": "mongodb",
    "risk_confidence_factor": 80,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "be8bb52caac5ca032065d704b374e795",
        "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
    },
    "target_context": {
        "dst_port": 27017,
        "service": "mongodb",
        "service_name": "mongodb",
        "risk_score": 33
    },
    "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
    "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ec07591ce3a77a20fb7e3637c93a0bbdbac6b53",
    "protocol_details": {
        "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
        "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 27017,
        "service": "mongodb",
        "service_label_fr": "MONGODB"
    },
    "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
    "target_port_label": "27017 \u00b7 MONGODB",
    "emulator_service": "mongodb",
    "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 80,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "mongodb",
        "service_label_fr": "MONGODB",
        "dst_port": 27017,
        "protocol_emulated": true,
        "tags_summary": [
            "ET-PROTO-MongoDB-Wire",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "ET-PROTO-MongoDB-Wire",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
            "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 27017,
            "service": "mongodb",
            "service_label_fr": "MONGODB"
        },
        "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "27017 \u00b7 MONGODB",
        "emulator_service": "mongodb",
        "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb",
        "service_banner": "honeypot-mongodb",
        "service_os": "linux",
        "dst_port": "27017"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mongodb_emulated",
        "mongodb_wire_protocol",
        "net_mongodb_wire_protocol",
        "solr_probe"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 2,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 115,
    "payload_entropy": 4.955869022603578,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb",
    "app_proto": "mongodb",
    "asn": 14061,
    "country": "US",
    "dst_port": 27017,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 33,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "003aa01523cfd5b494271e1e92efb43a3f4a8c5d",
    "event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
    "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "precision_score": 90,
    "precision_signals": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "classification_parent": "mongodb_probe",
    "service_name": "mongodb",
    "risk_confidence_factor": 80,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "46a10593cca7386db188dd5c77e3e079",
        "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
    },
    "target_context": {
        "dst_port": 27017,
        "service": "mongodb",
        "service_name": "mongodb",
        "risk_score": 33
    },
    "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c2f8537b98809b80306ef290e691102f7104c4d",
    "protocol_details": {
        "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
        "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 27017,
        "service": "mongodb",
        "service_label_fr": "MONGODB"
    },
    "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
    "target_port_label": "27017 \u00b7 MONGODB",
    "emulator_service": "mongodb",
    "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 80,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "mongodb",
        "service_label_fr": "MONGODB",
        "dst_port": 27017,
        "protocol_emulated": true,
        "tags_summary": [
            "ET-PROTO-MongoDB-Wire",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "ET-PROTO-MongoDB-Wire",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
            "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 27017,
            "service": "mongodb",
            "service_label_fr": "MONGODB"
        },
        "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27017\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "27017 \u00b7 MONGODB",
        "emulator_service": "mongodb",
        "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb",
        "service_banner": "honeypot-mongodb",
        "service_os": "linux",
        "dst_port": "27017"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mongodb_emulated",
        "mongodb_wire_protocol",
        "net_mongodb_wire_protocol",
        "solr_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 96,
    "payload_entropy": 4.9471234442917975,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 20,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "4a09a85bb7f75bb10a34217df02820dce786be9e",
    "event_fingerprint": "1f896c380dcb22d4820eb20cfe185729e3a2631d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "422961ac85bdee8cdcc76fdeebc4baa6",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8087,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
    },
    "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "49f6f4635c9c1baae2bba8e0003ea0690a7a19c2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 8087,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
    "target_port_label": "8087 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 8087,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
        "target_port_label": "8087 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_ua_suspicious",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 243,
    "payload_entropy": 5.744925697430502,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http-alt-8087",
    "app_proto": "http-alt-8087",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
    "event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8087",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "09f4126c3506195f1fd291429d8d88b4",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8087,
        "service": "http-alt-8087",
        "service_name": "http-alt-8087",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd+\ufffd!\u001bK\ufffd\u001a\ufffdG\ufffd\u0011\ufffd\ufffd\u0004\ufffd\u0006d\ufffdn(\ufffd,\u001d\ufffd\ufffd\u000b@Ao",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "14cf50dd12eb1ffd687df984338139987571d2f3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 8087,
        "service": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdQft\ufffd\ufffde@\ufffd\ufffdY*A\ufffdy*\ufffdcEG\ufffdJ\ufffdL\ufffd~ \ufffd^\ufffd\ufffd!pF\u01d1\ufffd\ufffdP\ufffd!\ufffdF\ufffdD\ufffd\ufffd\u0203c[\ufffdX\/'&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
    "target_port_label": "8087 \u00b7 HTTP ALT 8087",
    "emulator_service": "http-alt-8087",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8087",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 8087,
            "service": "http-alt-8087",
            "service_label_fr": "HTTP ALT 8087"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdQft\ufffd\ufffde@\ufffd\ufffdY*A\ufffdy*\ufffdcEG\ufffdJ\ufffdL\ufffd~ \ufffd^\ufffd\ufffd!pF\u01d1\ufffd\ufffdP\ufffd!\ufffdF\ufffdD\ufffd\ufffd\u0203c[\ufffdX\/'&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "8087 \u00b7 HTTP ALT 8087",
        "emulator_service": "http-alt-8087",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8087",
        "service_banner": "honeypot-http-alt-8087",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 243,
    "payload_entropy": 5.855063484799006,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http-alt-8087",
    "app_proto": "http-alt-8087",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
    "event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8087",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa168f9c63d9073aa93cfc4cf35e8adf",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8087,
        "service": "http-alt-8087",
        "service_name": "http-alt-8087",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdo\ufffd`\ufffd\ufffd]\u001f\ufffd\ufffd\u0376\u0006\ufffd\ufffdN\ufffd;\ufffdU)\ufffd\ufffd\ufffdor\ufffd$\ufffd_\ufffd,",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84341a0c92824ba6bf92effacfbeb1f1535263d3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 8087,
        "service": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdBqG\ufffdX\ufffdC9\ufffd\ufffd\ufffd E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd2\ufffdW&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
    "target_port_label": "8087 \u00b7 HTTP ALT 8087",
    "emulator_service": "http-alt-8087",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8087",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 8087,
            "service": "http-alt-8087",
            "service_label_fr": "HTTP ALT 8087"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdBqG\ufffdX\ufffdC9\ufffd\ufffd\ufffd E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd2\ufffdW&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "8087 \u00b7 HTTP ALT 8087",
        "emulator_service": "http-alt-8087",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8087",
        "service_banner": "honeypot-http-alt-8087",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 1,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
    "http_target_hash": "148d0a7b9fa867b9eb3d978e0caa495e68940f78",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 116,
    "payload_entropy": 5.282838815191514,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f1306cb307216c62e27854f8b14410432fc2b808",
    "event_fingerprint": "c7775fd013fcc70465962bab3d5b9426b1eefc73",
    "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "f765137bbb37749025ec0175d3b22884",
        "path_pattern_hash": "645c82d3be5cca3e8520101eb38681a7"
    },
    "target_context": {
        "dst_port": 8087,
        "service": "http",
        "service_name": "http",
        "risk_score": 24
    },
    "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/query",
    "query_string": "q=SHOW+DIAGNOSTICS",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
    "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/query",
        "query_string": "q=SHOW+DIAGNOSTICS",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
        "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "37ea594da07c39c28b88ccec80a4c5b30fb476fa",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/query",
        "request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 8087,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query",
    "target_port_label": "8087 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/query",
            "request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 8087,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query",
        "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "8087 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious",
        "net_sap_diag_probe"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "cgi",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
    "http_target_hash": "8add963f0e61f10c41c8eee4caf504d0e863a0b6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 113,
    "payload_entropy": 4.960487291614645,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 32,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 46,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "92d7c5fca0a67e5c41d3032f0b91136b4ac0ecc9",
    "event_fingerprint": "98a09d93e83ababbc2155c7ec01f1d0290693339",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 97,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "727ed3a4dd8cf7c513fe674850d2a21e",
        "path_pattern_hash": "45fb04fbc0c9ee592196ecdb80f81814"
    },
    "target_context": {
        "dst_port": 8087,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/cgi-bin\/authLogin.cgi",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
    "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/cgi-bin\/authLogin.cgi",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
        "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c6d98bdc9c54494f08c19a9d5abd7be3d97154fc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cgi-bin\/authLogin.cgi",
        "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 8087,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "config file probe \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
    "target_port_label": "8087 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cgi-bin\/authLogin.cgi",
            "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 8087,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
        "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "8087 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_cgi_bin",
        "http_sensitive_path",
        "http_ua_suspicious",
        "iot_http_endpoint",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c",
    "http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 148,
    "payload_entropy": 5.1417076098349215,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 96,
    "risk_classification": 84,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 65,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "aed5c6c3a69b40f51fe0dfc5098f618f0323a45e",
    "event_fingerprint": "031aed62a5a8e5a86ed0fe82cd5b21d371f071b8",
    "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
    "confidence": 0.58,
    "classification_confidence": 0.58,
    "precision_score": 55,
    "precision_signals": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 65,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f",
        "payload_hash": "e5bfe4f2df422756ac837a1dddace26b",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8087,
        "service": "http",
        "service_name": "http",
        "risk_score": 65
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ssrf_probe"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4f89caf8e0ef16a3a206ada3b0d1645d2929232f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
        "port": 8087,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "attack_vector": "ssrf attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
    "target_port_label": "8087 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 96,
            "classification": 84,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 65,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 65,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
            "port": 8087,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "ssrf attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "target_port_label": "8087 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 243,
    "payload_entropy": 5.838841351013588,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http-alt-8087",
    "app_proto": "http-alt-8087",
    "asn": 14061,
    "country": "US",
    "dst_port": 8087,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
    "event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8087",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e6af83f28c00e30c29839b7bbae90b27",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8087,
        "service": "http-alt-8087",
        "service_name": "http-alt-8087",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd}W\ufffd\u05f5\ufffdl\u0007Q\ufffd\ufffdbIAq.p\ufffdp\ufffd\u001fM\u0015\ufffdQ\ufffd`\ufffd\ufffd)",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4d94dcbb9abc0e0a0862fc7192bf033a9dfed27c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 8087,
        "service": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffdrE~\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdU\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\ufffd22-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
    "target_port_label": "8087 \u00b7 HTTP ALT 8087",
    "emulator_service": "http-alt-8087",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http-alt-8087",
        "service_label_fr": "HTTP ALT 8087",
        "dst_port": 8087,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8087",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 8087,
            "service": "http-alt-8087",
            "service_label_fr": "HTTP ALT 8087"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffdrE~\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdU\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\ufffd22-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "8087 \u00b7 HTTP ALT 8087",
        "emulator_service": "http-alt-8087",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8087",
        "service_banner": "honeypot-http-alt-8087",
        "service_os": "linux",
        "dst_port": "8087"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8087"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "c216e752cae6f8755fd27f561d031636",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 8,
    "bytes_in": 297,
    "payload_entropy": 5.746628977525633,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 14061,
    "country": "US",
    "dst_port": 9202,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ed8cd28c83fa5a7119f6d02bbe9b15f05e20143a",
    "event_fingerprint": "380814499cfaf25125d4df5d0994125324925ad7",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "c216e752cae6f8755fd27f561d031636",
        "payload_hash": "82a5ec0ae58e6a32b987e910025ebb4a",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 9202,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "57bcb3fdb2fce8bb3d680a99398b39e0b0a3b8a2",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "tls_ja3": "c216e752cae6f8755fd27f561d031636",
        "port": 9202,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "$ \ufffd\ufffd\ufffd+)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffddd\ufffd-\ufffdA\ufffdY;x\ufffd \ufffdOuX\ufffd)\ufffd\ufffdn\u01c5\ufffd\u782c\ufffd\"<\ufffdUk\ufffd\ufffd]\ufffdV\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
    "attack_vector": "tls probe \u00b7 via TLS:9202 \u00b7 (sonde \/ probe)",
    "target_port_label": "9202 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 9202,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
            "tls_ja3": "c216e752cae6f8755fd27f561d031636",
            "port": 9202,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:9202 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "$ \ufffd\ufffd\ufffd+)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffddd\ufffd-\ufffdA\ufffdY;x\ufffd \ufffdOuX\ufffd)\ufffd\ufffdn\u01c5\ufffd\u782c\ufffd\"<\ufffdUk\ufffd\ufffd]\ufffdV\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
        "target_port_label": "9202 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "9202"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "6e8c2e8656fc13dd6ead1c36834052efec40ef08",
    "http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 103,
    "payload_entropy": 4.933165189162168,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 9202,
    "risk_waf": 64,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "650a9e6509fd0e464317329280945b16aa8d8a17",
    "event_fingerprint": "9e8751a1384b706b2edf06f2c10263922c86e152",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "919078819394abd13f660956df7e5394",
        "path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
    },
    "target_context": {
        "dst_port": 9202,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/v2\/_catalog",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950316:lfi-14",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "nosqli-3"
    ],
    "request_line": "GET \/v2\/_catalog HTTP\/1.1",
    "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/v2\/_catalog",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950316:lfi-14",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "nosqli-3"
        ],
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "21424d6fdb156bb918094c6a79c909f19c8d62f2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v2\/_catalog",
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 9202,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:9202 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
    "target_port_label": "9202 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 78,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9202,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v2\/_catalog",
            "request_line": "GET \/v2\/_catalog HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 9202,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:9202 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
        "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9202 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9202"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950468:nosqli-3",
        "http_probe_registry",
        "http_ua_suspicious"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 3,
    "http_query_params": 2,
    "http_path_depth": 3,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "94eee6682281767a650397a64731a1855e069a99",
    "http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.0776944799500745,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 10086,
    "risk_waf": 60,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 60,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "4d7d16c94f763788c12a317a9407a27b7af18d63",
    "event_fingerprint": "17e01246ff0e8de53d474532e7bb539ce6dffdbe",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0754"
    ],
    "matched_pattern_names": [
        "ET solr admin"
    ],
    "pattern_ids": [
        "pat-0754"
    ],
    "confidence_breakdown": {
        "waf": 60,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 54
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "7c451a55434cc9b0608075edaeff4e5f",
        "path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
    },
    "target_context": {
        "dst_port": 10086,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
    "method": "GET",
    "path": "\/solr\/admin\/cores",
    "query_string": "action=STATUS&wt=json",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950325:rce-0",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3"
    ],
    "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
    "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/solr\/admin\/cores",
        "query_string": "action=STATUS&wt=json",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950325:rce-0",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3"
        ],
        "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
        "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "085e3f207a885f3ece08972248f7c585aa0bbf81",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/solr\/admin\/cores",
        "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 10086,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
    "target_port_label": "10086 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 60,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 54
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10086,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/solr\/admin\/cores",
            "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 10086,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
        "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "10086 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10086"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950325:rce-0",
        "950468:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_solr",
        "http_sensitive_path",
        "http_ua_suspicious"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 4,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "94eee6682281767a650397a64731a1855e069a99",
    "http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 115,
    "payload_entropy": 4.949304783454331,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 10086,
    "risk_waf": 32,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 46,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "4d7de05e81fe671d2700501707fec26480c17e05",
    "event_fingerprint": "7e46dca0a2750763c031746568006d9876c68dc7",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
    "confidence": 0.97,
    "classification_confidence": 0.97,
    "precision_score": 97,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0754"
    ],
    "matched_pattern_names": [
        "ET solr admin"
    ],
    "pattern_ids": [
        "pat-0754"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "88ab3461190d8ad4e91a1279dcf01cf3",
        "path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
    },
    "target_context": {
        "dst_port": 10086,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/solr\/admin\/info\/system",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
    "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/solr\/admin\/info\/system",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
        "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8c16ca236cab25f34e2afc0d1a34a1bd0ef9cb42",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/solr\/admin\/info\/system",
        "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 10086,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
    "target_port_label": "10086 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
        "confidence_pct": 97,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10086,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/solr\/admin\/info\/system",
            "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 10086,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
        "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "10086 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10086"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_solr",
        "http_sensitive_path",
        "http_ua_suspicious"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 116,
    "payload_entropy": 5.3000801945018585,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 24,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "16de334ba5aa8d79c6e5150a30d409df9f3db3ca",
    "event_fingerprint": "8a81a5f736b7db5d7944a448b5169fde2e93c5a4",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3d9d5b43a66fa7661d6ec760de74bb2",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 24
    },
    "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ccc791bd1359931cff92c3a50c8a1745d6abeb76",
    "protocol_details": {
        "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "net_sap_diag_probe",
        "sap_diag_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 243,
    "payload_entropy": 5.806882035792383,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "130ede751c4a85c99c44ad06247fa5e7",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 I\ufffd\ufffd\ufffd\ufffd\ufffd1\u001c\u001f_+\ufffd\u0000\ufffd%\ufffd\u0211\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd!",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "52ef0b095cb9b5ead48970b26a25fa56a1d553ea",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "\ufffd\ufffd8dY\\D\ufffdW\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd8dY\\D\ufffdW\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "net_couchdb_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 148,
    "payload_entropy": 5.1552211233484355,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 34,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "cd4aa24d616b8c8c9fdc7b65c18cba1fa792652c",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e65d85b200ab99fe1b990d4ac1a17f07",
        "path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 34
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b6579a325840b28904fef6de7c152bebd350498",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "mozi_pattern",
        "net_couchdb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 92,
    "payload_entropy": 4.87892518064,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c30a9cf5c8189e00696a39e7a75c648c",
        "path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 34
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "07a1586fb76cdd05ff8cbbc5b595c09c2ce63b8a",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "net_couchdb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 113,
    "payload_entropy": 4.978186406658893,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 66,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 66,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 41,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "ff5df85c211d5d3903035b95f6de1ea630b4065b",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 76,
    "precision_signals": [
        "INT-EMAIL-imap-login"
    ],
    "kb_rule_ids": [
        "INT-EMAIL-imap-login"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 66,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 41
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "215f62e8119229cec87d502e99c0877b",
        "path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 41
    },
    "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1110"
    ],
    "mitre": "T1110",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "260144661f702231c649eb4a0b055f735b2e5f3a",
    "protocol_details": {
        "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "imap bruteforce \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 66,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 41
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 41,
        "risk_label": "Moyen",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-EMAIL-imap-login"
        ],
        "tags_summary_labels_fr": [
            "Email Imap Login"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1110",
        "mitre_technique": "T1110",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "imap bruteforce \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "imap_probe",
        "net_couchdb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 243,
    "payload_entropy": 5.722519727754709,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b7a2f3bd84a28e4e0559cf51cfc9e367",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u001a\u02f4u\ufffd\ufffd\ufffd}\ufffd\u037b3h&\ufffd\\\ufffd\b\ufffd\ufffd\ufffd&\u001f\ufffd\t\u0017\ufffd\u000fY",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7bdf3cf3066e718e5ea7bc8f6ba1e105a027c8e2",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdKO\ufffd\ufffd\ufffdu~CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd \ufffd'\ufffd1C\ufffd5\ufffd\u03c6\ufffd]\ufffd)uw\ufffd\n{\ufffdO1\ufffd\ufffdZA\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdKO\ufffd\ufffd\ufffdu~CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd \ufffd'\ufffd1C\ufffd5\ufffd\u03c6\ufffd]\ufffd)uw\ufffd\n{\ufffdO1\ufffd\ufffdZA\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "net_couchdb_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 100,
    "payload_entropy": 5.018339231412708,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 48,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "eeb24ede3f547bd086820dac13d3da57d36ee8f1",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 87,
    "precision_signals": [
        "INT-INFRA-couchdb-db",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-INFRA-couchdb-db",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d9f97150d72ee0a95502b15842433048",
        "path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 48
    },
    "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "541f8fbe5466b9725e0e1ba53e818b26bd987e46",
    "protocol_details": {
        "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-INFRA-couchdb-db",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Infra Couchdb Db",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "couchdb_probe",
        "couchdb_rest_probe",
        "http_get_probe",
        "net_couchdb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 96,
    "payload_entropy": 4.9679567776251305,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "66ccdc6765c5de72ee856e3c8555b6b4",
        "path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
    },
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 34
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b99200811753fe477f22a8381b7e93c3473e64d9",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
    "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "http_get_probe",
        "net_couchdb_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
    "emulator_response_len": 286,
    "bytes_in": 243,
    "payload_entropy": 5.793306478990544,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "couchdb",
    "app_proto": "couchdb",
    "asn": 14061,
    "country": "US",
    "dst_port": 5984,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
    "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "couchdb",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ea6c451f9ce0f09d60311cefb5314ab7",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5984,
        "service": "couchdb",
        "service_name": "couchdb",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ]\ufffd\ufffd..\ufffd(8\ufffd%O\ufffd\ufffd\u001a4\ufffd\ufffd\ufffd\ufffd5\ufffdK\ufffd\ufffd\u001ei\ufffd\u001fYi(",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f3d617b62490ae9391dd653e7f3e5dac8005c21f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 5984,
        "service": "couchdb",
        "service_label_fr": "COUCHDB"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!~\ufffd\ufffd \ufffd\ufffdu\ufffd=k\ufffd\ufffd\ufffd=\ufffdw\ufffd\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
    "target_port_label": "5984 \u00b7 COUCHDB",
    "emulator_service": "couchdb",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "couchdb",
        "service_label_fr": "COUCHDB",
        "dst_port": 5984,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-couchdb",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 5984,
            "service": "couchdb",
            "service_label_fr": "COUCHDB"
        },
        "attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!~\ufffd\ufffd \ufffd\ufffdu\ufffd=k\ufffd\ufffd\ufffd=\ufffdw\ufffd\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "5984 \u00b7 COUCHDB",
        "emulator_service": "couchdb",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "couchdb",
        "service_banner": "honeypot-couchdb",
        "service_os": "linux",
        "dst_port": "5984"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "couchdb_emulated",
        "couchdb_payload",
        "net_couchdb_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 297,
    "payload_entropy": 5.821682234264164,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb-shard",
    "app_proto": "mongodb-shard",
    "asn": 14061,
    "country": "US",
    "dst_port": 27018,
    "risk_waf": 8,
    "risk_classification": 46,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 46,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "643e3aa2f37bd345e541ed726975a5b870d81f15",
    "event_fingerprint": "55615ed1096b55cc75e4676979dfeb7757337b99",
    "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
    "confidence": 0.64,
    "classification_confidence": 0.64,
    "precision_score": 71,
    "precision_signals": [
        "INT-mongo-shard",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-mongo-shard",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 46,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "mongodb-shard",
    "risk_confidence_factor": 64,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "50c5761d5992e3319999628ed814c97d",
        "path_pattern_hash": "19fbd5bc76140ff01438974534217dd2"
    },
    "target_context": {
        "dst_port": 27018,
        "service": "mongodb-shard",
        "service_name": "mongodb-shard",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a64d6e96c625177388df05a1a07886a31ac65519",
    "protocol_details": {
        "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
        "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "port": 27018,
        "service": "mongodb-shard",
        "service_label_fr": "MONGODB SHARD"
    },
    "evidence_snippet": "$ \ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd0`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`t=\u0272<\r\ufffd\ufffdoijE\ufffdp\ufffd.>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
    "attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
    "target_port_label": "27018 \u00b7 MONGODB SHARD",
    "emulator_service": "mongodb-shard",
    "confidence_reason": "Confiance 64 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
        "classification_reason_label_fr": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 64,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 46,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "mongodb-shard",
        "service_label_fr": "MONGODB SHARD",
        "dst_port": 27018,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-mongo-shard",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Mongo Shard",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb-shard",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
            "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
            "port": 27018,
            "service": "mongodb-shard",
            "service_label_fr": "MONGODB SHARD"
        },
        "attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "$ \ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd0`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`t=\u0272<\r\ufffd\ufffdoijE\ufffdp\ufffd.>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
        "target_port_label": "27018 \u00b7 MONGODB SHARD",
        "emulator_service": "mongodb-shard",
        "confidence_reason": "Confiance 64 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb_shard",
        "service_banner": "honeypot-mongodb-shard",
        "service_os": "linux",
        "dst_port": "27018"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mongodb_shard_emulated",
        "mongodb_shard_payload",
        "net_mongodb_shard_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 104,
    "payload_entropy": 4.96045829705678,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb-shard",
    "app_proto": "mongodb-shard",
    "asn": 14061,
    "country": "US",
    "dst_port": 27018,
    "risk_waf": 8,
    "risk_classification": 46,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 46,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 45,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "ed897a3b2d71206b7fbf99245bb007013d0d160a",
    "event_fingerprint": "55615ed1096b55cc75e4676979dfeb7757337b99",
    "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
    "confidence": 0.64,
    "classification_confidence": 0.64,
    "precision_score": 71,
    "precision_signals": [
        "INT-mongo-shard",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-mongo-shard",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 46,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "mongodb-shard",
    "risk_confidence_factor": 64,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4ad68297f51656a7480300225b6198d4",
        "path_pattern_hash": "19fbd5bc76140ff01438974534217dd2"
    },
    "target_context": {
        "dst_port": 27018,
        "service": "mongodb-shard",
        "service_name": "mongodb-shard",
        "risk_score": 45
    },
    "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3da25f1172dc3389a5e3129ea412b35ee401564e",
    "protocol_details": {
        "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
        "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 27018,
        "service": "mongodb-shard",
        "service_label_fr": "MONGODB SHARD"
    },
    "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
    "target_port_label": "27018 \u00b7 MONGODB SHARD",
    "emulator_service": "mongodb-shard",
    "confidence_reason": "Confiance 64 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
        "classification_reason_label_fr": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 64,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 46,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "mongodb-shard",
        "service_label_fr": "MONGODB SHARD",
        "dst_port": 27018,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-mongo-shard",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Mongo Shard",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb-shard",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
            "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 27018,
            "service": "mongodb-shard",
            "service_label_fr": "MONGODB SHARD"
        },
        "attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "27018 \u00b7 MONGODB SHARD",
        "emulator_service": "mongodb-shard",
        "confidence_reason": "Confiance 64 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb_shard",
        "service_banner": "honeypot-mongodb-shard",
        "service_os": "linux",
        "dst_port": "27018"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "elastic_probe",
        "http_get_probe",
        "mongodb_shard_emulated",
        "mongodb_shard_payload",
        "net_mongodb_shard_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 131,
    "payload_entropy": 5.0987241555391085,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb-config",
    "app_proto": "mongodb-config",
    "asn": 14061,
    "country": "US",
    "dst_port": 27019,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 32,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 32,
        "novelty": 15
    },
    "risk_score": 38,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a60b9deb7a9cbfa1c6e49edfebcc95ee4df6bd37",
    "event_fingerprint": "36841e4a8048e5c9be2652fb65ea4640a837374d",
    "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 93,
    "precision_signals": [
        "INT-SEC-solr-admin",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-SEC-solr-admin",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 32,
        "novelty": 15,
        "risk_score": 38
    },
    "named_classification_skipped": false,
    "service_name": "mongodb-config",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dcfa397b2f8f28e0927053df700dd53e",
        "path_pattern_hash": "1532cf2abc57fe877a1cb39330f129c4"
    },
    "target_context": {
        "dst_port": 27019,
        "service": "mongodb-config",
        "service_name": "mongodb-config",
        "risk_score": 38
    },
    "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
    "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "monitoring_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "132780e5bff693e44767a26004b1dddccddc8fa5",
    "protocol_details": {
        "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 27019,
        "service": "mongodb-config",
        "service_label_fr": "MONGODB CONFIG"
    },
    "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
    "target_port_label": "27019 \u00b7 MONGODB CONFIG",
    "emulator_service": "mongodb-config",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 32,
            "novelty": 15,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "mongodb-config",
        "service_label_fr": "MONGODB CONFIG",
        "dst_port": 27019,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-SEC-solr-admin",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Console admin Apache Solr",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb-config",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 27019,
            "service": "mongodb-config",
            "service_label_fr": "MONGODB CONFIG"
        },
        "attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "27019 \u00b7 MONGODB CONFIG",
        "emulator_service": "mongodb-config",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb_config",
        "service_banner": "honeypot-mongodb-config",
        "service_os": "linux",
        "dst_port": "27019"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "solr_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
    "emulator_response_len": 62,
    "bytes_in": 115,
    "payload_entropy": 4.973260326951405,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "mongodb-config",
    "app_proto": "mongodb-config",
    "asn": 14061,
    "country": "US",
    "dst_port": 27019,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 32,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 32,
        "novelty": 15
    },
    "risk_score": 38,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a60b9deb7a9cbfa1c6e49edfebcc95ee4df6bd37",
    "event_fingerprint": "36841e4a8048e5c9be2652fb65ea4640a837374d",
    "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 93,
    "precision_signals": [
        "INT-SEC-solr-admin",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-SEC-solr-admin",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 32,
        "novelty": 15,
        "risk_score": 38
    },
    "named_classification_skipped": false,
    "service_name": "mongodb-config",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a967f753ea4fb35384ac6c57150ade40",
        "path_pattern_hash": "1532cf2abc57fe877a1cb39330f129c4"
    },
    "target_context": {
        "dst_port": 27019,
        "service": "mongodb-config",
        "service_name": "mongodb-config",
        "risk_score": 38
    },
    "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "monitoring_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "941f05456e38cef36a34bf89fb8af1ca4174c9d7",
    "protocol_details": {
        "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 27019,
        "service": "mongodb-config",
        "service_label_fr": "MONGODB CONFIG"
    },
    "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
    "target_port_label": "27019 \u00b7 MONGODB CONFIG",
    "emulator_service": "mongodb-config",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 32,
            "novelty": 15,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "mongodb-config",
        "service_label_fr": "MONGODB CONFIG",
        "dst_port": 27019,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-SEC-solr-admin",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Console admin Apache Solr",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mongodb-config",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 27019,
            "service": "mongodb-config",
            "service_label_fr": "MONGODB CONFIG"
        },
        "attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "27019 \u00b7 MONGODB CONFIG",
        "emulator_service": "mongodb-config",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mongodb_config",
        "service_banner": "honeypot-mongodb-config",
        "service_os": "linux",
        "dst_port": "27019"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "solr_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
    "emulator_response_len": 172,
    "http_header_count": 3,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
    "http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 116,
    "payload_entropy": 5.034790160917155,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch",
    "app_proto": "elasticsearch",
    "asn": 14061,
    "country": "US",
    "dst_port": 9200,
    "risk_waf": 48,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 50,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 48,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25
    },
    "risk_score": 43,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b314e05ccaca9d318cb7e51d317b528fa9c1a295",
    "event_fingerprint": "ed23d7883983626253e3ecc0bfe647d76c8ba300",
    "classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0342"
    ],
    "kb_rule_ids": [
        "pat-0342"
    ],
    "matched_patterns": [
        "pat-0342"
    ],
    "matched_pattern_names": [
        "ES cat indices"
    ],
    "pattern_ids": [
        "pat-0342"
    ],
    "confidence_breakdown": {
        "waf": 48,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25,
        "risk_score": 43
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "ccab3a5526cd63b45db967d3c93802bb",
        "path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
    },
    "target_context": {
        "dst_port": 9200,
        "service": "elasticsearch",
        "service_name": "elasticsearch",
        "risk_score": 43
    },
    "payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/_cat\/indices",
    "query_string": "format=json",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3",
        "950607:elastic-cat"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "elastic-cat"
    ],
    "request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
    "request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/_cat\/indices",
        "query_string": "format=json",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3",
            "950607:elastic-cat"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "elastic-cat"
        ],
        "request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
        "request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6e2866c0a67a552d1bf2d5a029d7f8b898620276",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/_cat\/indices",
        "request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
        "port": 9200,
        "service": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH"
    },
    "evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
    "target_port_label": "9200 \u00b7 ELASTICSEARCH",
    "emulator_service": "elasticsearch",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 43\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 48,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 50,
            "novelty": 25,
            "risk_score": 43
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH",
        "dst_port": 9200,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0342"
        ],
        "tags_summary_labels_fr": [
            "pat-0342"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Elasticsearch 8.11",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/_cat\/indices",
            "request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
            "port": 9200,
            "service": "elasticsearch",
            "service_label_fr": "ELASTICSEARCH"
        },
        "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
        "evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9200 \u00b7 ELASTICSEARCH",
        "emulator_service": "elasticsearch",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch",
        "service_banner": "Elasticsearch 8.11",
        "service_os": "linux",
        "dst_port": "9200"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "950607:elastic-cat",
        "http_probe_elastic",
        "http_ua_suspicious",
        "net_elasticsearch_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
    "emulator_response_len": 172,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 4,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
    "http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 114,
    "payload_entropy": 4.951735055507564,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch",
    "app_proto": "elasticsearch",
    "asn": 14061,
    "country": "US",
    "dst_port": 9200,
    "risk_waf": 32,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 50,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.3,
    "risk_breakdown": {
        "waf": 32,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25
    },
    "risk_score": 45,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "e04f8ec99812a2328029a122ca901143eb01c77e",
    "event_fingerprint": "8c33725be688e5224ee30e2588756785a8a34fcd",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 68,
    "precision_signals": [
        "pat-0754"
    ],
    "kb_rule_ids": [
        "pat-0754"
    ],
    "matched_patterns": [
        "pat-0754"
    ],
    "matched_pattern_names": [
        "ET solr admin"
    ],
    "pattern_ids": [
        "pat-0754"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch",
    "risk_confidence_factor": 57,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "d79e62f489c6d545fb6da68e22b820c9",
        "path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
    },
    "target_context": {
        "dst_port": 9200,
        "service": "elasticsearch",
        "service_name": "elasticsearch",
        "risk_score": 45
    },
    "payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/solr\/admin\/info\/system",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
    "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/solr\/admin\/info\/system",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
        "request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "516f611ee4d0bec98ecdea7306dd7c1e0bcb8670",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/solr\/admin\/info\/system",
        "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/info\/system",
        "port": 9200,
        "service": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH"
    },
    "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/info\/system",
    "target_port_label": "9200 \u00b7 ELASTICSEARCH",
    "emulator_service": "elasticsearch",
    "confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 50,
            "novelty": 25,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH",
        "dst_port": 9200,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0754"
        ],
        "tags_summary_labels_fr": [
            "pat-0754"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Elasticsearch 8.11",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/solr\/admin\/info\/system",
            "request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/info\/system",
            "port": 9200,
            "service": "elasticsearch",
            "service_label_fr": "ELASTICSEARCH"
        },
        "attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/info\/system",
        "evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9200 \u00b7 ELASTICSEARCH",
        "emulator_service": "elasticsearch",
        "confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch",
        "service_banner": "Elasticsearch 8.11",
        "service_os": "linux",
        "dst_port": "9200"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_solr",
        "http_sensitive_path",
        "http_ua_suspicious",
        "net_elasticsearch_probe"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
    "emulator_response_len": 172,
    "http_header_count": 3,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
    "http_target_hash": "e3801637f4e20ff756436cae7ea6a14f0a14f884",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 99,
    "payload_entropy": 4.887418939614036,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch",
    "app_proto": "elasticsearch",
    "asn": 14061,
    "country": "US",
    "dst_port": 9200,
    "risk_waf": 20,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 50,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 20,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 15
    },
    "risk_score": 22,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f5c706d584f258613df0890f290076064d9813ba",
    "event_fingerprint": "098920f5126a62ee13d43b53d4ee5ea90d49db9d",
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 20,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 15,
        "risk_score": 22
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "c6b58563b4a5cc8147a29b9880fbfa3a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9200,
        "service": "elasticsearch",
        "service_name": "elasticsearch",
        "risk_score": 22
    },
    "payload_preview": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "query_string": "pretty",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/?pretty HTTP\/1.1",
    "request_sample": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pretty",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/?pretty HTTP\/1.1",
        "request_sample": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f88da7ba230c3d96ff331d4fe6437060b7b9f8d2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/?pretty HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/?pretty",
        "port": 9200,
        "service": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH"
    },
    "evidence_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
    "target_port_label": "9200 \u00b7 ELASTICSEARCH",
    "emulator_service": "elasticsearch",
    "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 50,
            "novelty": 15,
            "risk_score": 22
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 22,
        "risk_label": "Faible",
        "service_name": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH",
        "dst_port": 9200,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Elasticsearch 8.11",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/?pretty HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/?pretty",
            "port": 9200,
            "service": "elasticsearch",
            "service_label_fr": "ELASTICSEARCH"
        },
        "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9200 \u00b7 ELASTICSEARCH",
        "emulator_service": "elasticsearch",
        "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch",
        "service_banner": "Elasticsearch 8.11",
        "service_os": "linux",
        "dst_port": "9200"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_ua_suspicious",
        "net_elasticsearch_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
    "emulator_response_len": 172,
    "http_header_count": 3,
    "http_query_params": 2,
    "http_path_depth": 3,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
    "http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.079361691078381,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch",
    "app_proto": "elasticsearch",
    "asn": 14061,
    "country": "US",
    "dst_port": 9200,
    "risk_waf": 60,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 50,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25
    },
    "risk_score": 46,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "f73f6c2d8a960e3faa52cbed3f4c02e6b4f2f52e",
    "event_fingerprint": "c6ed935311cbbd02dbe47f705b1bf1a4eee44197",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 68,
    "precision_signals": [
        "pat-0754"
    ],
    "kb_rule_ids": [
        "pat-0754"
    ],
    "matched_patterns": [
        "pat-0754"
    ],
    "matched_pattern_names": [
        "ET solr admin"
    ],
    "pattern_ids": [
        "pat-0754"
    ],
    "confidence_breakdown": {
        "waf": 60,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 25,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch",
    "risk_confidence_factor": 57,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "adbbf5c94ec0bab6c0ad9b3bf51fbbbc",
        "path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
    },
    "target_context": {
        "dst_port": 9200,
        "service": "elasticsearch",
        "service_name": "elasticsearch",
        "risk_score": 46
    },
    "payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n",
    "method": "GET",
    "path": "\/solr\/admin\/cores",
    "query_string": "action=STATUS&wt=json",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950325:rce-0",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3"
    ],
    "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
    "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/solr\/admin\/cores",
        "query_string": "action=STATUS&wt=json",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950325:rce-0",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3"
        ],
        "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
        "request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7aedb2f173f47c63d9856f72a85442e36807e4a3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/solr\/admin\/cores",
        "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/cores?action=STATUS&wt=json",
        "port": 9200,
        "service": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH"
    },
    "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/cores",
    "target_port_label": "9200 \u00b7 ELASTICSEARCH",
    "emulator_service": "elasticsearch",
    "confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 46\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 60,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 50,
            "novelty": 25,
            "risk_score": 46
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH",
        "dst_port": 9200,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0754"
        ],
        "tags_summary_labels_fr": [
            "pat-0754"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Elasticsearch 8.11",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/solr\/admin\/cores",
            "request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/cores?action=STATUS&wt=json",
            "port": 9200,
            "service": "elasticsearch",
            "service_label_fr": "ELASTICSEARCH"
        },
        "attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/cores",
        "evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9200 \u00b7 ELASTICSEARCH",
        "emulator_service": "elasticsearch",
        "confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch",
        "service_banner": "Elasticsearch 8.11",
        "service_os": "linux",
        "dst_port": "9200"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950325:rce-0",
        "950468:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_solr",
        "http_sensitive_path",
        "http_ua_suspicious",
        "net_elasticsearch_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
    "emulator_response_len": 172,
    "http_header_count": 3,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
    "http_target_hash": "53bde7c84dc4dc98126ef993b7b218052b711371",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 114,
    "payload_entropy": 4.960903621107942,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "elasticsearch",
    "app_proto": "elasticsearch",
    "asn": 14061,
    "country": "US",
    "dst_port": 9200,
    "risk_waf": 32,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 50,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "91d2e7506a9875f0debdfdad206687c85bb79c1f",
    "event_fingerprint": "d5d9e95d93081a1c53ae48aba60dbed362b00ae8",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0343",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0343",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0343"
    ],
    "matched_pattern_names": [
        "ES cluster health"
    ],
    "pattern_ids": [
        "pat-0343"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 50,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "elasticsearch",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "b1a301cbc718c2d738afd670ea118454",
        "path_pattern_hash": "bf1b7d0b38d26e824261898ee406b457"
    },
    "target_context": {
        "dst_port": 9200,
        "service": "elasticsearch",
        "service_name": "elasticsearch",
        "risk_score": 40
    },
    "payload_preview": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/_cluster\/health",
    "query_string": "pretty",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
    "request_sample": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/_cluster\/health",
        "query_string": "pretty",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
        "request_sample": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1a535efad52c621c96259511ee9be7aef4672b33",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/_cluster\/health",
        "request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cluster\/health?pretty",
        "port": 9200,
        "service": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH"
    },
    "evidence_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cluster\/health",
    "target_port_label": "9200 \u00b7 ELASTICSEARCH",
    "emulator_service": "elasticsearch",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 50,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "elasticsearch",
        "service_label_fr": "ELASTICSEARCH",
        "dst_port": 9200,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0343",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0343",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Elasticsearch 8.11",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/_cluster\/health",
            "request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cluster\/health?pretty",
            "port": 9200,
            "service": "elasticsearch",
            "service_label_fr": "ELASTICSEARCH"
        },
        "attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cluster\/health",
        "evidence_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "9200 \u00b7 ELASTICSEARCH",
        "emulator_service": "elasticsearch",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "elasticsearch",
        "service_banner": "Elasticsearch 8.11",
        "service_os": "linux",
        "dst_port": "9200"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_ua_suspicious",
        "net_elasticsearch_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 297,
    "payload_entropy": 5.835542887178731,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "rabbitmq-amqp-alt",
    "app_proto": "rabbitmq-amqp-alt",
    "asn": 14061,
    "country": "US",
    "dst_port": 15671,
    "risk_waf": 8,
    "risk_classification": 43,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 43,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "040536fe3395b1b40d1b3ed5518168535b7e9f5f",
    "event_fingerprint": "b9f59d3714affe35498245ea9ddd6ed9d5c90042",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 43,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "rabbitmq-amqp-alt",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6545fb5b899b039921154fbe0643d92f",
        "path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
    },
    "target_context": {
        "dst_port": 15671,
        "service": "rabbitmq-amqp-alt",
        "service_name": "rabbitmq-amqp-alt",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2ef7bd7dc5c543db0b55c5498e51024d29543d2",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
        "port": 15671,
        "service": "rabbitmq-amqp-alt",
        "service_label_fr": "RABBITMQ AMQP ALT"
    },
    "evidence_snippet": "$ O\ufffd;\ufffd\ufffdY\ufffd|\r\\,w\ufffdL#\ufffdy\ufffdH\ufffd2X\ufffd\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\t>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
    "attack_vector": "amqp probe \u00b7 via RABBITMQ AMQP ALT:15671 \u00b7 (sonde \/ probe)",
    "target_port_label": "15671 \u00b7 RABBITMQ AMQP ALT",
    "emulator_service": "rabbitmq-amqp-alt",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 43,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "rabbitmq-amqp-alt",
        "service_label_fr": "RABBITMQ AMQP ALT",
        "dst_port": 15671,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rabbitmq-amqp-alt",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
            "port": 15671,
            "service": "rabbitmq-amqp-alt",
            "service_label_fr": "RABBITMQ AMQP ALT"
        },
        "attack_vector": "amqp probe \u00b7 via RABBITMQ AMQP ALT:15671 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "$ O\ufffd;\ufffd\ufffdY\ufffd|\r\\,w\ufffdL#\ufffdy\ufffdH\ufffd2X\ufffd\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\t>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
        "target_port_label": "15671 \u00b7 RABBITMQ AMQP ALT",
        "emulator_service": "rabbitmq-amqp-alt",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rabbitmq_amqp_alt",
        "service_banner": "honeypot-rabbitmq-amqp-alt",
        "service_os": "linux",
        "dst_port": "15671"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "rabbitmq-amqp-alt"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "amqp_emulated",
        "net_amqp_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "8601cef8c1a410d202a4b0e031c4e59225bb7c01",
    "http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 4.930215537174793,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 15671,
    "risk_waf": 64,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 52,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "90129db9effc1b2cb7682f848c90bfc4545fac56",
    "event_fingerprint": "86bcf3854dbb3657ebe93567a561cb4d70380cac",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 78,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "dbec8893abf7e903d42a1291d235c53d",
        "path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
    },
    "target_context": {
        "dst_port": 15671,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/v2\/_catalog",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950316:lfi-14",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "nosqli-3"
    ],
    "request_line": "GET \/v2\/_catalog HTTP\/1.1",
    "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/v2\/_catalog",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950316:lfi-14",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "nosqli-3"
        ],
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "44984ed923ac0a9ce4a6df11143ed7f00d103cc9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v2\/_catalog",
        "request_line": "GET \/v2\/_catalog HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 15671,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:15671 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
    "target_port_label": "15671 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 78,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15671,
        "protocol_emulated": true,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v2\/_catalog",
            "request_line": "GET \/v2\/_catalog HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 15671,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:15671 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
        "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "15671 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15671"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950468:nosqli-3",
        "http_probe_registry",
        "http_ua_suspicious",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a",
    "emulator_response_len": 60,
    "bytes_in": 5,
    "payload_entropy": 1.9219280948873623,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "zookeeper",
    "app_proto": "zookeeper",
    "asn": 14061,
    "country": "US",
    "dst_port": 2181,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "799665ba2feb5b28e885503d11fc53fcc5d6a97c",
    "event_fingerprint": "a14d5f3d8510c5c8ed26794618586d29bf6943c9",
    "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "zookeeper",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6cac8f0a754db2892f30d9e02f68cc10",
        "path_pattern_hash": "456831beef3fc1500939995d7369695f"
    },
    "target_context": {
        "dst_port": 2181,
        "service": "zookeeper",
        "service_name": "zookeeper",
        "risk_score": 0
    },
    "payload_preview": "srvr\n",
    "request_sample": "srvr\n",
    "payload_snippet": "srvr",
    "evidence": {
        "request_sample": "srvr\n",
        "payload_snippet": "srvr",
        "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a4a8413d8d76163250e4fa9cfe2d68020d904a9a",
    "protocol_details": {
        "payload_preview": "srvr",
        "port": 2181,
        "service": "zookeeper",
        "service_label_fr": "ZOOKEEPER"
    },
    "evidence_snippet": "srvr",
    "attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
    "target_port_label": "2181 \u00b7 ZOOKEEPER",
    "emulator_service": "zookeeper",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 40,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "zookeeper",
        "service_label_fr": "ZOOKEEPER",
        "dst_port": 2181,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-zookeeper",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "srvr",
            "port": 2181,
            "service": "zookeeper",
            "service_label_fr": "ZOOKEEPER"
        },
        "attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "srvr",
        "target_port_label": "2181 \u00b7 ZOOKEEPER",
        "emulator_service": "zookeeper",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "zookeeper",
        "service_banner": "honeypot-zookeeper",
        "service_os": "linux",
        "dst_port": "2181"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a",
    "emulator_response_len": 60,
    "bytes_in": 5,
    "payload_entropy": 2.321928094887362,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "zookeeper",
    "app_proto": "zookeeper",
    "asn": 14061,
    "country": "US",
    "dst_port": 2181,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "799665ba2feb5b28e885503d11fc53fcc5d6a97c",
    "event_fingerprint": "a14d5f3d8510c5c8ed26794618586d29bf6943c9",
    "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "zookeeper",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d40a54d34a106e80e51499bb41f59bc0",
        "path_pattern_hash": "456831beef3fc1500939995d7369695f"
    },
    "target_context": {
        "dst_port": 2181,
        "service": "zookeeper",
        "service_name": "zookeeper",
        "risk_score": 0
    },
    "payload_preview": "cons\n",
    "request_sample": "cons\n",
    "payload_snippet": "cons",
    "evidence": {
        "request_sample": "cons\n",
        "payload_snippet": "cons",
        "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "37bab6914a8ff0c162be463093b21678960e1a94",
    "protocol_details": {
        "payload_preview": "cons",
        "port": 2181,
        "service": "zookeeper",
        "service_label_fr": "ZOOKEEPER"
    },
    "evidence_snippet": "cons",
    "attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
    "target_port_label": "2181 \u00b7 ZOOKEEPER",
    "emulator_service": "zookeeper",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 40,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "zookeeper",
        "service_label_fr": "ZOOKEEPER",
        "dst_port": 2181,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-zookeeper",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "cons",
            "port": 2181,
            "service": "zookeeper",
            "service_label_fr": "ZOOKEEPER"
        },
        "attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "cons",
        "target_port_label": "2181 \u00b7 ZOOKEEPER",
        "emulator_service": "zookeeper",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "zookeeper",
        "service_banner": "honeypot-zookeeper",
        "service_os": "linux",
        "dst_port": "2181"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 116,
    "payload_entropy": 5.24098749646502,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 14061,
    "country": "US",
    "dst_port": 1434,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 48,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 48,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6da1789e0ad45120eece1ff5b4a8249d4c4af3a6",
    "event_fingerprint": "40137d96bb752a7247071c548273f04549b28579",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 48,
        "novelty": 15,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "371d7293bcecad9823da21dfea13a920",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 1434,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 24
    },
    "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "58582fea6ca2aa696e93838fddeea6c7c1fb718b",
    "protocol_details": {
        "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "port": 1434,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1434 \u00b7 (sonde \/ probe)",
    "target_port_label": "1434 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 40,
            "protocol": 48,
            "novelty": 15,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 1434,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
            "port": 1434,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1434 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "1434 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "1434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_sap_diag_probe",
        "sap_diag_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.786352102033492,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 14061,
    "country": "US",
    "dst_port": 1434,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2cf103f954c60e81dc10c69c201fcdda5cfa54dc",
    "event_fingerprint": "49296f9ac59bf54b662c3e70f4330ed9641e6005",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "payload_hash": "ad2cde9736064676de6c18a82a93a8f9",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "e4d60caa902b8b84112358f96af813c3",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
    "tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 1434,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd&\ufffdF~G\ufffd-\ufffd~Z\u0002J\f*\ufffd\ufffd#sa\ufffdX\ufffd<\ufffd\ufffd5\u00150\u001e",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4863c03c35b20e33272f4f5b934b6996214aaefb",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
        "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
        "port": 1434,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffda\\~\ufffd\ufffd\u00c8\ufffda\ufffd\ufffdo^w\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd r:\ufffdX\ufffd\ufffd\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g(\ufffd\ufffd\ufffdqB`e\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
    "target_port_label": "1434 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 1434,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
            "tls_ja4": "e4d60caa902b8b84112358f96af813c3",
            "port": 1434,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffda\\~\ufffd\ufffd\u00c8\ufffda\ufffd\ufffdo^w\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd r:\ufffdX\ufffd\ufffd\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g(\ufffd\ufffd\ufffdqB`e\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "1434 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "1434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "sap-diag",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c",
    "http_host_hash": "20f633e7cff478c2585f58298d013520fa99a95f",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 148,
    "payload_entropy": 5.119781174038729,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 1434,
    "risk_waf": 96,
    "risk_classification": 84,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 61,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "882d6aaceef8cddb7a8ced18c6d2a7568bf88dee",
    "event_fingerprint": "35c21b2fbdbf24e94c6bd7174d7e7a26a7819e4d",
    "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
    "confidence": 0.58,
    "classification_confidence": 0.58,
    "precision_score": 55,
    "precision_signals": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 61,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f",
        "payload_hash": "9f67ddd5b940f72bb2e4a9a711121abd",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1434,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ssrf_probe"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "038c7949fe76020c4973d21e1b372f24f3df7019",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
        "port": 1434,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
    "attack_vector": "ssrf attack \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit)",
    "target_port_label": "1434 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 96,
            "classification": 84,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 61,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1434,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
            "port": 1434,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "ssrf attack \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
        "target_port_label": "1434 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "sap-diag",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "cgi",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "20f633e7cff478c2585f58298d013520fa99a95f",
    "http_target_hash": "8add963f0e61f10c41c8eee4caf504d0e863a0b6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 113,
    "payload_entropy": 4.91752487593081,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "US",
    "dst_port": 1434,
    "risk_waf": 32,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 46,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "d42d5f7a678cd770575e9d7d6d5efbd710d63d22",
    "event_fingerprint": "07c5e4f5d149f34e23230554e8d139914d0d8e8a",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 97,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "686167e783cfa80aa9c6c25399cfa951",
        "path_pattern_hash": "45fb04fbc0c9ee592196ecdb80f81814"
    },
    "target_context": {
        "dst_port": 1434,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/cgi-bin\/authLogin.cgi",
    "user_agent": "Go-http-client\/1.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
    "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/cgi-bin\/authLogin.cgi",
        "user_agent": "Go-http-client\/1.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
        "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e66141593cb48be9f2517752a60d20eb2864b91b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cgi-bin\/authLogin.cgi",
        "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 1434,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
    "attack_vector": "config file probe \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
    "target_port_label": "1434 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1434,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cgi-bin\/authLogin.cgi",
            "request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 1434,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
        "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
        "target_port_label": "1434 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "sap-diag",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_cgi_bin",
        "http_sensitive_path",
        "http_ua_suspicious",
        "iot_http_endpoint"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}