160.119.71.136

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
    "http_host_hash": "8dc5c2eabde3c76f9b1c4a9c85a2aa65363aad39",
    "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 977,
    "payload_entropy": 5.669385940343185,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9103,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "9c45450a2a48d7fd42162d5675f4fd6c036fed3d",
    "event_fingerprint": "cfcf41e4b835e7e7ccb10fa7dd132dec12b97669",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
        "payload_hash": "e4ab1b6ff0b74e2a96ce251b242b052f",
        "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
    },
    "target_context": {
        "dst_port": 9103,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "method": "POST",
    "path": "\/_next\/server",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next\/server HTTP\/1.1",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "evidence": {
        "method": "POST",
        "path": "\/_next\/server",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a013a536fbd092cba7a598bb54a0b3590c3f8684",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next\/server",
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
        "port": 9103,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
    "target_port_label": "9103 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9103,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next\/server",
            "request_line": "POST \/_next\/server HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
            "port": 9103,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
        "target_port_label": "9103 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9103"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9103"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
    "http_host_hash": "8dc5c2eabde3c76f9b1c4a9c85a2aa65363aad39",
    "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 973,
    "payload_entropy": 5.66743640376512,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9103,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "847db9558686b9ffbdf58f87b520e0856ed93f85",
    "event_fingerprint": "7d9277f85381ecfdebae0b7265c82095cad7a7f7",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c772734c6eb2978096c283068906aec3",
        "payload_hash": "c8e69a862138269e61e0f8f24b6b4127",
        "path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
    },
    "target_context": {
        "dst_port": 9103,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ",
    "method": "POST",
    "path": "\/_next",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next HTTP\/1.1",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
    "evidence": {
        "method": "POST",
        "path": "\/_next",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next HTTP\/1.1",
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "03c432ac2a2dc99d30509e63004c049e6b91337f",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next",
        "request_line": "POST \/_next HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
        "port": 9103,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
    "target_port_label": "9103 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9103,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next",
            "request_line": "POST \/_next HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
            "port": 9103,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
        "target_port_label": "9103 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9103"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9103"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
    "http_host_hash": "8dc5c2eabde3c76f9b1c4a9c85a2aa65363aad39",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 958,
    "payload_entropy": 5.676651416387939,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9103,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "4bbde1af824709991ac0db02e152faaaee8a427f",
    "event_fingerprint": "48cac11adf3a0bf3f6060a6652364a4a803c3d3f",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6c8160595869adea51d6742918f57fdf",
        "payload_hash": "23a58cc9e31411226614ad092b6078a8",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9103,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f884dd44df4305a8f4b221239db9a719d79d7093",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
        "port": 9103,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit)",
    "target_port_label": "9103 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9103,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
            "port": 9103,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9103 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9103\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
        "target_port_label": "9103 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9103"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9103"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": null,
    "app_proto": null,
    "asn": 49870,
    "country": "SC",
    "dst_port": 9103,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a61b9358f6f1a09116dd10e6a797b9b4f45ea943",
    "event_fingerprint": "b3c20024c5b76f0ea0d1832e27f68f10e72ac9b5",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9103,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f82cddbaeeba9bb4b05469e455ac247dd76dfaa4",
    "protocol_details": {
        "port": 9103
    },
    "attack_vector": "Sonde port \u00b7 port 9103 \u00b7 (sonde \/ probe)",
    "target_port_label": "9103",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9103,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 9103
        },
        "attack_vector": "Sonde port \u00b7 port 9103 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9103",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9103"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 945,
    "payload_entropy": 5.674141138873535,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "b58a50974c0701164a8c04b76f4febc5ce2a5279",
    "event_fingerprint": "7ca207b015c47974d679716dc29f31a03bf32f86",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
        "payload_hash": "a623d46c9790f83c22448f85fe19d179",
        "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "method": "POST",
    "path": "\/app",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/app HTTP\/1.1",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "evidence": {
        "method": "POST",
        "path": "\/app",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/app HTTP\/1.1",
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cd9060a1d3c827385f0a32fb4cff2e0ec9cb6914",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/app",
        "request_line": "POST \/app HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/app",
            "request_line": "POST \/app HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 919,
    "payload_entropy": 5.6145888562546435,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 15,
    "anomaly_count": 0,
    "campaign_key": "ee6ebf040119ce9a2f8ba9bd5bffef72df837ea1",
    "event_fingerprint": "649475c4e08706eed7b046dcbd1e2a291f6fddbd",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f10b48170735feac18b44fa385fef37",
        "payload_hash": "92d57d0bcbbda59ee3e364c3fc64dbd1",
        "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
    "method": "POST",
    "path": "\/api\/route",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api\/route HTTP\/1.1",
    "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop",
    "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
    "evidence": {
        "method": "POST",
        "path": "\/api\/route",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api\/route HTTP\/1.1",
        "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop",
        "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "30c735e1fa7d7eb771b949ddbc17a71001188b3b",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api\/route",
        "request_line": "POST \/api\/route HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api\/route",
            "request_line": "POST \/api\/route HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
        "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 953,
    "payload_entropy": 5.653167715239615,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "dde06c89526e30d5e58b6fbbb964421ac4811386",
    "event_fingerprint": "7a3306a85cf7310918d698d322825b8e2d5a9a6a",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
        "payload_hash": "25f731d63258785b466ad4a3e6aaf603",
        "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
    "method": "POST",
    "path": "\/_next\/server",
    "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next\/server HTTP\/1.1",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
    "evidence": {
        "method": "POST",
        "path": "\/_next\/server",
        "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b80e444a2fba24c1378a3a10690cb356607444f2",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next\/server",
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next\/server",
            "request_line": "POST \/_next\/server HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 951,
    "payload_entropy": 5.6616545936766975,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 13,
    "anomaly_count": 0,
    "campaign_key": "51c9895f3cf1a5c35aa493b2bdd6ac8033c4a3f7",
    "event_fingerprint": "b367f3831c16c8084670c361ece5aff7c12dece2",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
        "payload_hash": "6c84ee811342b4da9ce090049e144a59",
        "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "method": "POST",
    "path": "\/api",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api HTTP\/1.1",
    "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
    "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "evidence": {
        "method": "POST",
        "path": "\/api",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api HTTP\/1.1",
        "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
        "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "494a0b323bf9817930ae47d7be18fc19f3b15e84",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api",
        "request_line": "POST \/api HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api",
            "request_line": "POST \/api HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
        "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 945,
    "payload_entropy": 5.635399169140279,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "b58a50974c0701164a8c04b76f4febc5ce2a5279",
    "event_fingerprint": "e196f788ba5074e4db39b546cf6b16fee7f4fad9",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
        "payload_hash": "2b80b10d6ba00f401df820ee00facda5",
        "path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
    "method": "POST",
    "path": "\/_next",
    "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next HTTP\/1.1",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
    "evidence": {
        "method": "POST",
        "path": "\/_next",
        "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next HTTP\/1.1",
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3732e9fd2f40ca135f92ac02b25724ff2bf3b24a",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next",
        "request_line": "POST \/_next HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next",
            "request_line": "POST \/_next HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": null,
    "app_proto": null,
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "62b38cc8cbe9d3957db00e896effdfaf6e259c05",
    "event_fingerprint": "26a7b34f17168a08e9948d3bc6f330bfffe0be48",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 18081,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "550da7a1cca1079d870c20e8ec959799d2536322",
    "protocol_details": {
        "port": 18081
    },
    "attack_vector": "Sonde port \u00b7 port 18081 \u00b7 (sonde \/ probe)",
    "target_port_label": "18081",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 18081
        },
        "attack_vector": "Sonde port \u00b7 port 18081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "18081",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
    "http_host_hash": "7b06b96bcd180658123a3ee7bb98664a210056c9",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 976,
    "payload_entropy": 5.689416112389695,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 18081,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 72,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "8ac60d9b6df55057b12c422771cb975a97c9e1b6",
    "event_fingerprint": "742da673d9f1b6a4d53cc01e48c57ede6de0187d",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 72,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c772734c6eb2978096c283068906aec3",
        "payload_hash": "bf65106d2b2a67f4bda13e2b895dd375",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 18081,
        "service": "http",
        "service_name": "http",
        "risk_score": 72
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTW",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enc",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTW",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enc",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTW",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7322785c22d4df49f1844fad0d071eb445154a55",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
        "port": 18081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTW",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit)",
    "target_port_label": "18081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 72,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 72,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
            "port": 18081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:18081 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18081\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTW",
        "target_port_label": "18081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 959,
    "payload_entropy": 5.648719087584354,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa678bfc1383e6b711ee1ebc801ffc71",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
    "evidence": {
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cb8ea1082b9f8c66ee44010f018cd1f06a9ee1be",
    "protocol_details": {
        "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 975,
    "payload_entropy": 5.6750507925805485,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f0b2e4be60eeb2f546903b415a55d059",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
    "evidence": {
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a4c9ef695b6e3e1d8135923bee54c860ddd43e02",
    "protocol_details": {
        "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 977,
    "payload_entropy": 5.665643063277093,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d02c5f160d649f1d25a916fdab96f6a5",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
    "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
    "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
    "evidence": {
        "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
        "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "18ad63e3dcdd37c7163c6b4e3e5e29ccde11044b",
    "protocol_details": {
        "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 988,
    "payload_entropy": 5.683519577920771,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "270baaed32b0b2b0b3c1894a5700ebfb",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
    "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
    "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
    "evidence": {
        "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
        "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5035a617c6c408cb4184576b6989a248b1810496",
    "protocol_details": {
        "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 989,
    "payload_entropy": 5.649709874203667,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2c585df57f82fff392c4e1cce7546296",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "evidence": {
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a2e7c128fe981e1f18546ea47ffd1d38249379b7",
    "protocol_details": {
        "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "aeb784db56a0273c9be644ad51ff0292c40bd044",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "a6f7713503e08b2580844867d22bf612"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7e4aec5a22ccb6d8473a025d711dbf765ef2ea1d",
    "protocol_details": {
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "attack_vector": "clickhouse probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (sonde \/ probe)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "clickhouse probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "clickhouse_native_emulated",
        "net_clickhouse_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a",
    "emulator_response_len": 35,
    "bytes_in": 958,
    "payload_entropy": 5.661826155564418,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "clickhouse-native",
    "app_proto": "clickhouse-native",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9009,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "043556947c4db56f3ef401efbbd3917e047ba184",
    "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "clickhouse-native",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9088f449a5c1bc91f5f1109ec37c5462",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 9009,
        "service": "clickhouse-native",
        "service_name": "clickhouse-native",
        "risk_score": 52
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "evidence": {
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1512616f980caee72e9a74e8bbfafeb06de4bdfe",
    "protocol_details": {
        "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
        "port": 9009,
        "service": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
    "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
    "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
    "emulator_service": "clickhouse-native",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via CLICKHOUSE NATIVE",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "clickhouse-native",
        "service_label_fr": "CLICKHOUSE NATIVE",
        "dst_port": 9009,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-clickhouse-native",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
            "port": 9009,
            "service": "clickhouse-native",
            "service_label_fr": "CLICKHOUSE NATIVE"
        },
        "attack_vector": "http smuggling probe \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
        "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE",
        "emulator_service": "clickhouse-native",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "clickhouse_native",
        "service_banner": "honeypot-clickhouse-native",
        "service_os": "linux",
        "dst_port": "9009"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "clickhouse_native_emulated",
        "clickhouse_native_payload",
        "mozi_pattern",
        "net_clickhouse_probe"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 920,
    "payload_entropy": 5.643102831988406,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "0612e32dc2a92cfefa4d273b996db0f5fc4dab81",
    "event_fingerprint": "8701efa188e01ba2f043d81042b0838cdb0d46f4",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "72d43eb808798db218d063798749cc39",
        "payload_hash": "5d1199eba01a837552f6f0c96bab7fec",
        "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
    "method": "POST",
    "path": "\/app",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/app HTTP\/1.1",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
    "evidence": {
        "method": "POST",
        "path": "\/app",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/app HTTP\/1.1",
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d3ceb4e07ce4fb9484be34a1877209abfefcaf9f",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/app",
        "request_line": "POST \/app HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/app",
            "request_line": "POST \/app HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 956,
    "payload_entropy": 5.6521544012253235,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 15,
    "anomaly_count": 0,
    "campaign_key": "88e9bcc654042a8a67b1c8bdb9b723ac37c166ea",
    "event_fingerprint": "375696fa3c692024ae5e39ece5edfe48a50b77b6",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
        "payload_hash": "832e578e241670ceeb2fda66e3abfcbd",
        "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
    "method": "POST",
    "path": "\/api\/route",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api\/route HTTP\/1.1",
    "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
    "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
    "evidence": {
        "method": "POST",
        "path": "\/api\/route",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api\/route HTTP\/1.1",
        "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
        "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a440f385850afa6c2a60ec563d24253e322f7f04",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api\/route",
        "request_line": "POST \/api\/route HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api\/route",
            "request_line": "POST \/api\/route HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
        "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 937,
    "payload_entropy": 5.666615664158715,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 13,
    "anomaly_count": 0,
    "campaign_key": "8a83297254cd53a170e1d34a5c5afedb0f0f954a",
    "event_fingerprint": "dfe62bd112e5b30b4e9eed24f2377ba08121b27e",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
        "payload_hash": "6558a2a30cc6c1289d935e0546f071d5",
        "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "method": "POST",
    "path": "\/api",
    "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api HTTP\/1.1",
    "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
    "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "evidence": {
        "method": "POST",
        "path": "\/api",
        "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api HTTP\/1.1",
        "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
        "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "559d76a3803e4fd98f39370ab645667743092acd",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api",
        "request_line": "POST \/api HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api",
            "request_line": "POST \/api HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
        "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 936,
    "payload_entropy": 5.656894528534243,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "a43b3d3a78a3f47a3eaa34e384b1d67f85963623",
    "event_fingerprint": "ca1c68daed44945b6012e53e3e4a83868a970dd0",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "72d43eb808798db218d063798749cc39",
        "payload_hash": "2f5c8ae506c4d535ed2a2f7631404bfe",
        "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
    "method": "POST",
    "path": "\/_next\/server",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next\/server HTTP\/1.1",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
    "evidence": {
        "method": "POST",
        "path": "\/_next\/server",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bd7e32a94d3bb4e4afca1c59345363bb678194ec",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next\/server",
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next\/server",
            "request_line": "POST \/_next\/server HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 938,
    "payload_entropy": 5.628041383085493,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "0612e32dc2a92cfefa4d273b996db0f5fc4dab81",
    "event_fingerprint": "6a232eeef4745784e0f0a7388372f75bf6aec370",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
        "payload_hash": "fb66a236ff63f0d5ebbaefeafb5475c1",
        "path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
    "method": "POST",
    "path": "\/_next",
    "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next HTTP\/1.1",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
    "evidence": {
        "method": "POST",
        "path": "\/_next",
        "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next HTTP\/1.1",
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b107b66d149a347424ce887e8950c3a2621d2bcf",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next",
        "request_line": "POST \/_next HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next",
            "request_line": "POST \/_next HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": null,
    "app_proto": null,
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5d4db5b3b9a320414905a344d0eec0428bfd3b83",
    "event_fingerprint": "47a9092ed1315138afa9483dfd5134e553583d45",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 4020,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f480c3ef4fa52ab1f977bd8fb85ae7dc92fa8ecf",
    "protocol_details": {
        "port": 4020
    },
    "attack_vector": "Sonde port \u00b7 port 4020 \u00b7 (sonde \/ probe)",
    "target_port_label": "4020",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 4020
        },
        "attack_vector": "Sonde port \u00b7 port 4020 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4020",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
    "http_host_hash": "f7ea29c136b7a1f62dba1aed521fa89763912b3c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 918,
    "payload_entropy": 5.632456194452862,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 4020,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 74,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "56bfd41b216fd8600d56abf0a3b988763e002f6c",
    "event_fingerprint": "f561959769e9dc8ad95375faa4cda60a754acf10",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 74,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "72d43eb808798db218d063798749cc39",
        "payload_hash": "b6dbb373845b434f3e3dcf5c2ff7d9a2",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 4020,
        "service": "http",
        "service_name": "http",
        "risk_score": 74
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "24ecf1220ddc8894e02f6f366e6eddea16f5cd68",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 4020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit)",
    "target_port_label": "4020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 74,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 74,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 4020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4020\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
        "target_port_label": "4020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:4020"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 936,
    "payload_entropy": 5.647433909408858,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 13,
    "anomaly_count": 0,
    "campaign_key": "5a72349dc31bd981230ac0172474b0f968a41ea4",
    "event_fingerprint": "0442a2b6aeec325a31fdc5afec0ddd2c3097ba41",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
        "payload_hash": "eaa5c5baa0bc21a59a7e0886d1dcd345",
        "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "method": "POST",
    "path": "\/api",
    "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api HTTP\/1.1",
    "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
    "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "evidence": {
        "method": "POST",
        "path": "\/api",
        "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api HTTP\/1.1",
        "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
        "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4ece7f246a5bbf63351b01dca45e09d49944b299",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api",
        "request_line": "POST \/api HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api",
            "request_line": "POST \/api HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
        "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 951,
    "payload_entropy": 5.643463492039091,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "56de14b6da7b7ee5f75418f69325d7075326b223",
    "event_fingerprint": "568f90af42078fe912dcb87026d72ad6f0e53dac",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
        "payload_hash": "b8bc56184e0b1f030a1a9b907e541a69",
        "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
    "method": "POST",
    "path": "\/_next\/server",
    "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next\/server HTTP\/1.1",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
    "evidence": {
        "method": "POST",
        "path": "\/_next\/server",
        "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "69fe9df29eb38666d1ac5703d3f36cfad5c4f435",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next\/server",
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next\/server",
            "request_line": "POST \/_next\/server HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 944,
    "payload_entropy": 5.669187019295813,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "a139b2505dd571b1d0d4d7d3c30a651d56256fb0",
    "event_fingerprint": "9e7757c9025d133598684e87d4c2b62e8b7fa192",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
        "payload_hash": "02aa2ffb048805cd831491362da5e5df",
        "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "method": "POST",
    "path": "\/app",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/app HTTP\/1.1",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "evidence": {
        "method": "POST",
        "path": "\/app",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/app HTTP\/1.1",
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfe8a28a53169c5ae52594dde2a16852360bcd0e",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/app",
        "request_line": "POST \/app HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/app",
            "request_line": "POST \/app HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 911,
    "payload_entropy": 5.599875846973032,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 15,
    "anomaly_count": 0,
    "campaign_key": "3b7c435a40196d934fb32abc25bf9fc1cfd69a37",
    "event_fingerprint": "9dcd14b7073af45c623b33213882ec19a43d2259",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f10b48170735feac18b44fa385fef37",
        "payload_hash": "91d780aa97f247e2d9cc36ef3d4eb12f",
        "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "method": "POST",
    "path": "\/api\/route",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api\/route HTTP\/1.1",
    "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
    "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "evidence": {
        "method": "POST",
        "path": "\/api\/route",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api\/route HTTP\/1.1",
        "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
        "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "73ecbe32f1403c5f3e976986902c6aa74f969dd8",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api\/route",
        "request_line": "POST \/api\/route HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api\/route",
            "request_line": "POST \/api\/route HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
        "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 908,
    "payload_entropy": 5.620285179845095,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "a139b2505dd571b1d0d4d7d3c30a651d56256fb0",
    "event_fingerprint": "26a3129e3a68ac65e2169204dfbdd084b4549018",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f10b48170735feac18b44fa385fef37",
        "payload_hash": "9d34c01976b0d6a20224b2527bcd53b6",
        "path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "method": "POST",
    "path": "\/_next",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next HTTP\/1.1",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "evidence": {
        "method": "POST",
        "path": "\/_next",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next HTTP\/1.1",
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7a27ac0489806f4eb1cf803bb2f403ec4966e195",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next",
        "request_line": "POST \/_next HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next",
            "request_line": "POST \/_next HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
    "http_host_hash": "fe437a0a4a57314a98f9eab6880ad33f9aafcd53",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 940,
    "payload_entropy": 5.633959589044618,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 6.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 75,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "987ea3fb74ee6e7605ede78df146a7c487c785db",
    "event_fingerprint": "20c955fa418ebea8b4c9ecf0552af61ff19f1699",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 75,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
        "payload_hash": "057377c478c444b9a0b94a54babfb417",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 6006,
        "service": "http",
        "service_name": "http",
        "risk_score": 75
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d0862616308297515c1d4891b69209930b3b7d64",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
        "port": 6006,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit)",
    "target_port_label": "6006 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 75,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 75,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
            "port": 6006,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:6006 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
        "target_port_label": "6006 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6006"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": null,
    "app_proto": null,
    "asn": 49870,
    "country": "SC",
    "dst_port": 6006,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "422b2d64bd461b54bd63917df3e0ae70ccf47727",
    "event_fingerprint": "43f78a87be7bb1c2b93596c35fada37fe42c27dd",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 6006,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "815d0eccef4b48ff8876e0d3985e580d977e9450",
    "protocol_details": {
        "port": 6006
    },
    "attack_vector": "Sonde port \u00b7 port 6006 \u00b7 (sonde \/ probe)",
    "target_port_label": "6006",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6006,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 6006
        },
        "attack_vector": "Sonde port \u00b7 port 6006 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "6006",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6006"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 971,
    "payload_entropy": 5.669531374016475,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "4ddee4f2b566a3f89850446b3081ea35337fc95d",
    "event_fingerprint": "f48efbae81a3b4acbe64ea1aec3064daf11e76b9",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
        "payload_hash": "f568fd85b780aa5758d005ee2b2907e5",
        "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "method": "POST",
    "path": "\/_next\/server",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next\/server HTTP\/1.1",
    "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
    "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "evidence": {
        "method": "POST",
        "path": "\/_next\/server",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
        "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5c5b9648fffe6942f423dc3b31968dd2facf480c",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next\/server",
        "request_line": "POST \/_next\/server HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next\/server",
            "request_line": "POST \/_next\/server HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
        "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 905,
    "payload_entropy": 5.598297140448858,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "45a23fc2e48d6f47ce55d25e2985ab4a6c0e79af",
    "event_fingerprint": "f3edefae705011176609f3ac47e13c237580ed4d",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9f10b48170735feac18b44fa385fef37",
        "payload_hash": "3c275b7abd7affb0121ba00104180f01",
        "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "method": "POST",
    "path": "\/app",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/app HTTP\/1.1",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "evidence": {
        "method": "POST",
        "path": "\/app",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/app HTTP\/1.1",
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "54696bd0d44a1aaeec1b3d43088d32ff10b1aa61",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/app",
        "request_line": "POST \/app HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/app",
            "request_line": "POST \/app HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 967,
    "payload_entropy": 5.68017148143259,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 15,
    "anomaly_count": 0,
    "campaign_key": "c006dc84e4f32ce64c770defa6d187ba6857d7fe",
    "event_fingerprint": "1074dfa25e30d16034b32b37e181f93c759bb8b4",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6c8160595869adea51d6742918f57fdf",
        "payload_hash": "03066a3d3a1a1470627c8e798bb745a0",
        "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
    "method": "POST",
    "path": "\/api\/route",
    "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api\/route HTTP\/1.1",
    "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
    "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
    "evidence": {
        "method": "POST",
        "path": "\/api\/route",
        "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api\/route HTTP\/1.1",
        "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
        "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2449547fe250596b7481b3710a5f80cb591be6ae",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api\/route",
        "request_line": "POST \/api\/route HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api\/route",
            "request_line": "POST \/api\/route HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
        "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 960,
    "payload_entropy": 5.648938283234485,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "45a23fc2e48d6f47ce55d25e2985ab4a6c0e79af",
    "event_fingerprint": "cd90a462fa4f2925604789648a3a42b451e373b1",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
        "payload_hash": "9fea4bf95d72824e23628b88f2f8ad16",
        "path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "method": "POST",
    "path": "\/_next",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/_next HTTP\/1.1",
    "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
    "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "evidence": {
        "method": "POST",
        "path": "\/_next",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/_next HTTP\/1.1",
        "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
        "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eb0ee8db670b12a6419e55db0a334e1f5dc4b924",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/_next",
        "request_line": "POST \/_next HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/_next",
            "request_line": "POST \/_next HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
        "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 937,
    "payload_entropy": 5.643297709605465,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 13,
    "anomaly_count": 0,
    "campaign_key": "d0a216a45b71e8d281a50d86057032e8087976ad",
    "event_fingerprint": "7f406ac4e0894f6f3ba7933789afd4c4ab3a549e",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
        "payload_hash": "f4b1226de0dff3745a4c9e6afa67f074",
        "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "method": "POST",
    "path": "\/api",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "k8s-api"
    ],
    "request_line": "POST \/api HTTP\/1.1",
    "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
    "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "evidence": {
        "method": "POST",
        "path": "\/api",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "k8s-api"
        ],
        "request_line": "POST \/api HTTP\/1.1",
        "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
        "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bfd6fc9b333f8bb313eded11e29b59f398fd74cc",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/api",
        "request_line": "POST \/api HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/api",
            "request_line": "POST \/api HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
        "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950600:k8s-api",
        "http_contenttype_attack_surface",
        "http_probe_api",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
    "http_host_hash": "efd359d7730487067695df440ead79cac8492741",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 985,
    "payload_entropy": 5.684541089670066,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 73,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "dff45b9689e3d5b7f6d34a013565db222290539f",
    "event_fingerprint": "1a928387f67cd7ac313ecfbb35eade1e5b2824d3",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 73,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
        "payload_hash": "dffffaca9ddf4827de505b9183d22b8a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9063,
        "service": "http",
        "service_name": "http",
        "risk_score": 73
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0f7a4bbf8e0e91ebaaaed9542e11bc7eada2a9b4",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
        "port": 9063,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit)",
    "target_port_label": "9063 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 73,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 73,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
            "port": 9063,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9063 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9063\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
        "target_port_label": "9063 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9063"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "950734:sap-sapcontrol-path",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": null,
    "app_proto": null,
    "asn": 49870,
    "country": "SC",
    "dst_port": 9063,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ea3d1f9bcbbc53783686699ae261bf5dc683ac3e",
    "event_fingerprint": "947e05d7b338f0d52e53e371d9bac4d44167c9bf",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9063,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5d083b2fc5f7630f6cc7da9e8a7b8778be895771",
    "protocol_details": {
        "port": 9063
    },
    "attack_vector": "Sonde port \u00b7 port 9063 \u00b7 (sonde \/ probe)",
    "target_port_label": "9063",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9063,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 9063
        },
        "attack_vector": "Sonde port \u00b7 port 9063 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9063",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9063"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
    "http_host_hash": "7c72f8496a5c3da3a33955ab7bbd4fa5d19cbf5a",
    "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 984,
    "payload_entropy": 5.679094039412131,
    "port_category": "registered",
    "org": "Alsycon B.V.",
    "service": "http",
    "app_proto": "http",
    "asn": 49870,
    "country": "SC",
    "dst_port": 9113,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 10,
    "risk_granularity": 7.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 76,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "5acc84e4038faf67d5edf118f9441e252ed2d660",
    "event_fingerprint": "bef533af63f3a1b390260aa8e7a3f52cff618f81",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 76,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 49870,
        "org": "Alsycon B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c772734c6eb2978096c283068906aec3",
        "payload_hash": "8c48bc376a0602a266d66d2b2082330e",
        "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
    },
    "target_context": {
        "dst_port": 9113,
        "service": "http",
        "service_name": "http",
        "risk_score": 76
    },
    "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
    "method": "POST",
    "path": "\/app",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
    "waf_tags": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0"
    ],
    "waf_rule_names": [
        "sqli-4",
        "rce-0",
        "rce-2",
        "rce-14",
        "nosqli-3",
        "proto-0",
        "upload-0"
    ],
    "request_line": "POST \/app HTTP\/1.1",
    "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
    "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
    "evidence": {
        "method": "POST",
        "path": "\/app",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
        "waf_tags": [
            "950019:sqli-4",
            "950326:rce-0",
            "950327:rce-0",
            "950335:rce-2",
            "950382:rce-14",
            "950470:nosqli-3",
            "950493:proto-0",
            "950549:upload-0"
        ],
        "waf_rule_names": [
            "sqli-4",
            "rce-0",
            "rce-2",
            "rce-14",
            "nosqli-3",
            "proto-0",
            "upload-0"
        ],
        "request_line": "POST \/app HTTP\/1.1",
        "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
        "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "82c34561c3982f5a0a57b077219b95d73470139b",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/app",
        "request_line": "POST \/app HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
        "port": 9113,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:9113 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
    "target_port_label": "9113 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 76,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 76,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9113,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/app",
            "request_line": "POST \/app HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
            "port": 9113,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:9113 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
        "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9113\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
        "target_port_label": "9113 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9113"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9113"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950019:sqli-4",
        "950326:rce-0",
        "950327:rce-0",
        "950335:rce-2",
        "950382:rce-14",
        "950470:nosqli-3",
        "950493:proto-0",
        "950549:upload-0",
        "http_contenttype_attack_surface",
        "http_prototype_pollution",
        "http_ssti"
    ]
}