161.118.232.74

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "e7082bf89fb3315806e7ae6952f0a88884c69468",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 5.140687741579728,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "86d99fcf2ca40c2f8eb0d0a7731ce6ce4112f018",
    "event_fingerprint": "76768b4fd1f8c5766b46a32738a1426ead76d9f2",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0495"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_rsa"
    ],
    "pattern_ids": [
        "pat-0495"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "a0c8b3f26eb581d76bc54d11eb935fd5",
        "path_pattern_hash": "7db94f5d7ea5ac98ea13d8c61becd367"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/id_rsa",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/id_rsa HTTP\/1.1",
    "request_sample": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/id_rsa",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/id_rsa HTTP\/1.1",
        "request_sample": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22bf7d6bbc6a2da2f42e329e54a58612537e473e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/id_rsa",
        "request_line": "GET \/id_rsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/id_rsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/id_rsa",
            "request_line": "GET \/id_rsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/id_rsa",
        "evidence_snippet": "GET \/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "0f51bc792d6f938bb82ea19d1935c3464eb59ea8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.180943864476143,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "86d99fcf2ca40c2f8eb0d0a7731ce6ce4112f018",
    "event_fingerprint": "a818e05af408fef2d4910b8815c0800e89e95724",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "82e10b1a5bb7d468a8a0c93b2f028aac",
        "path_pattern_hash": "fb2942fad108fb946e981f9671efa9dc"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/private_key.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/private_key.pem HTTP\/1.1",
    "request_sample": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/private_key.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/private_key.pem HTTP\/1.1",
        "request_sample": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ba599fb3fd8ffba7141b3b7bdad89f2502dfeb6f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/private_key.pem",
        "request_line": "GET \/private_key.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/private_key.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/private_key.pem",
            "request_line": "GET \/private_key.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/private_key.pem",
        "evidence_snippet": "GET \/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c38233937d4cc7696706a130ae02abb754cd3b86",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 134,
    "payload_entropy": 5.156069161371331,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "72dea92533808322f88d9db4026878d7d3949704",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "3fbf9c81b1564d44d0487edf753f7e85",
        "path_pattern_hash": "63fe0378076381c1e294548d5a1e275c"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "method": "GET",
    "path": "\/privatekey.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/privatekey.pem HTTP\/1.1",
    "request_sample": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "evidence": {
        "method": "GET",
        "path": "\/privatekey.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/privatekey.pem HTTP\/1.1",
        "request_sample": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dc6a9368cf560dcbfebdf0910e03630fa12bbc69",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/privatekey.pem",
        "request_line": "GET \/privatekey.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/privatekey.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/privatekey.pem",
            "request_line": "GET \/privatekey.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/privatekey.pem",
        "evidence_snippet": "GET \/privatekey.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "b524b6abf08c6490c78a365c0a4f75e33ebe69a1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 140,
    "payload_entropy": 5.190758886935227,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d93b297131c97e3d758de4c2aa8aad7761bea2e8",
    "event_fingerprint": "18fb8c1fe822d25f847a92afa955dad5ec72b574",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "8c70b72db0bdc7bd5852f14112f88f3f",
        "path_pattern_hash": "ddfa2a6515a6ed06b7561da77f0521cb"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "method": "GET",
    "path": "\/keys\/private_key.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/private_key.pem HTTP\/1.1",
    "request_sample": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/private_key.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/private_key.pem HTTP\/1.1",
        "request_sample": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "438a868f2f4e080bd2ba48454bdca6dbc2dc80cb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/private_key.pem",
        "request_line": "GET \/keys\/private_key.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/private_key.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/private_key.pem",
            "request_line": "GET \/keys\/private_key.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/private_key.pem",
        "evidence_snippet": "GET \/keys\/private_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "93e5e70927fb7f8df587ab4218301889f91361d9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.168006319593399,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ae0b4d262bf2defd23dc106869c3bcebb27187b7",
    "event_fingerprint": "c35577c82369be3cf91c162dae650df4fc0a9abd",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "4fd87987025fc4fa8df18cc6baaeee5e",
        "path_pattern_hash": "9f86707f7dd859da92a1ebdac76f9f27"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/keys\/gpu-key.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/gpu-key.pem HTTP\/1.1",
    "request_sample": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/gpu-key.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/gpu-key.pem HTTP\/1.1",
        "request_sample": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25b3bc5c5c9ee3021ab1cd8f568a80c5bc083332",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/gpu-key.pem",
        "request_line": "GET \/keys\/gpu-key.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/gpu-key.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/gpu-key.pem",
            "request_line": "GET \/keys\/gpu-key.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/gpu-key.pem",
        "evidence_snippet": "GET \/keys\/gpu-key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "98ed7fcd2be4090859f0172147623de5167de374",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.184145371924511,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ae0b4d262bf2defd23dc106869c3bcebb27187b7",
    "event_fingerprint": "9e4b3ba32896e74ee4197c7edc4d9b4301cdfcfb",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "98bee10863ea5c7746ccc550102d1e53",
        "path_pattern_hash": "d0d2fcc585df88b349bbf1500e82bdeb"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/keys\/deploy_key",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/deploy_key HTTP\/1.1",
    "request_sample": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/deploy_key",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/deploy_key HTTP\/1.1",
        "request_sample": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bbf46a5b2b111d6cb927aa54ee69a2b46d708bf3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/deploy_key",
        "request_line": "GET \/keys\/deploy_key HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/deploy_key",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/deploy_key",
            "request_line": "GET \/keys\/deploy_key HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/deploy_key",
        "evidence_snippet": "GET \/keys\/deploy_key HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d2c05747377111a5eec125610ae9cba9c50b103a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 132,
    "payload_entropy": 5.159279178117062,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ae0b4d262bf2defd23dc106869c3bcebb27187b7",
    "event_fingerprint": "8df28135424b9de6c45dc95f669984e5761ddc3c",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "ba099f0e8d4d55c31e741759bbd1006b",
        "path_pattern_hash": "a32a85c7bc6c7c45d601900e5e93df07"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "method": "GET",
    "path": "\/keys\/gpu.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/gpu.pem HTTP\/1.1",
    "request_sample": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/gpu.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/gpu.pem HTTP\/1.1",
        "request_sample": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "441ee960de7b3ed86086b7860fd008f8e71d0ec4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/gpu.pem",
        "request_line": "GET \/keys\/gpu.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/gpu.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/gpu.pem",
            "request_line": "GET \/keys\/gpu.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/gpu.pem",
        "evidence_snippet": "GET \/keys\/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f5c9a39e3b8326cd60e2e99395c77ab8376eafda",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.199591428831232,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ae0b4d262bf2defd23dc106869c3bcebb27187b7",
    "event_fingerprint": "0f264381bdefe18aec103ca7647680a3b58580cb",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "matched_patterns": [
        "pat-0492"
    ],
    "matched_pattern_names": [
        "Cred SSH private key ed25519"
    ],
    "pattern_ids": [
        "pat-0492"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1bfe3d7c8ab5997aca1e832e2f40f1d6",
        "path_pattern_hash": "eea860102516a586ae85186d48b4c3ae"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/keys\/id_ed25519",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/id_ed25519 HTTP\/1.1",
    "request_sample": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/id_ed25519",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/id_ed25519 HTTP\/1.1",
        "request_sample": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c6d20987969089d6d7d85e19621af1d0f5e1f8a1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/id_ed25519",
        "request_line": "GET \/keys\/id_ed25519 HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/id_ed25519",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/id_ed25519",
            "request_line": "GET \/keys\/id_ed25519 HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/keys\/id_ed25519",
        "evidence_snippet": "GET \/keys\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/known_hosts",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "fb12d69a82089354effdda2c19d658a5cdaf0d65",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.1584256658521745,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "a51d94103cb2f1846dafa196a1a6b36dcb9d1b7d",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0491",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0491",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0491"
    ],
    "matched_pattern_names": [
        "Cred SSH known_hosts"
    ],
    "pattern_ids": [
        "pat-0491"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "c4d7be5496d8b5b2f6c09b272d88110b",
        "path_pattern_hash": "4da9973e85b574677b68fdcc97136a4e"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/.ssh\/known_hosts",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/known_hosts HTTP\/1.1",
    "request_sample": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/known_hosts",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/known_hosts HTTP\/1.1",
        "request_sample": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "29635fb1afbb2dcbb66de52375bee19f6176fc1f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/known_hosts",
        "request_line": "GET \/.ssh\/known_hosts HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/known_hosts",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0491",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0491",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/known_hosts",
            "request_line": "GET \/.ssh\/known_hosts HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/known_hosts",
        "evidence_snippet": "GET \/.ssh\/known_hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ac37ce7e667bd3bc1eba862f64c398c379fe2d59",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.178802208941192,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d93b297131c97e3d758de4c2aa8aad7761bea2e8",
    "event_fingerprint": "555497b4f9ef1f90f77cc47e3abb32a21f10cd23",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0495"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_rsa"
    ],
    "pattern_ids": [
        "pat-0495"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1f8d1295466d99221ae81bb4248a9283",
        "path_pattern_hash": "9d81f664fa843ac47730f41a2954f798"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/keys\/id_rsa",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/keys\/id_rsa HTTP\/1.1",
    "request_sample": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/keys\/id_rsa",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/keys\/id_rsa HTTP\/1.1",
        "request_sample": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "384801646826ab9b4d0321b5f92e23f04f85f9d8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/keys\/id_rsa",
        "request_line": "GET \/keys\/id_rsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys\/id_rsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/keys\/id_rsa",
            "request_line": "GET \/keys\/id_rsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys\/id_rsa",
        "evidence_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_keys",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "00eb33f20eb26af307f8295d4b4607a45a669c84",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.1132037055433,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "34fa8eb170f74b992238c76b5fa25ca79630d096",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "8ff7da81e61ec3017e653405930aae36",
        "path_pattern_hash": "4e9d4f83a9a9d2ca3992bef66c7d702a"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
    "method": "GET",
    "path": "\/ssh\/config",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ssh\/config HTTP\/1.1",
    "request_sample": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ssh\/config",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ssh\/config HTTP\/1.1",
        "request_sample": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1eb70d2ca34f0ca1e506e619ef07609d6d2ea74e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ssh\/config",
        "request_line": "GET \/ssh\/config HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/config",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ssh\/config",
            "request_line": "GET \/ssh\/config HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/config",
        "evidence_snippet": "GET \/ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "4b56a6db295512a54c56d5851c96454b27c22b3b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 139,
    "payload_entropy": 5.18522702158253,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "e20356647e4af47aff04010a7b5b6430da7f5abd",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6a0f3139f33d8539e1c4416988da6ffc",
        "path_pattern_hash": "52c742b31f610e618f70ed479591e732"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "method": "GET",
    "path": "\/ssh\/authorized_keys",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ssh\/authorized_keys HTTP\/1.1",
    "request_sample": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "evidence": {
        "method": "GET",
        "path": "\/ssh\/authorized_keys",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ssh\/authorized_keys HTTP\/1.1",
        "request_sample": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "374982329e747d3f85f48a3d76c8411b56bb9be5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ssh\/authorized_keys",
        "request_line": "GET \/ssh\/authorized_keys HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/authorized_keys",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ssh\/authorized_keys",
            "request_line": "GET \/ssh\/authorized_keys HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/authorized_keys",
        "evidence_snippet": "GET \/ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "8b98ce7fb4212f60f13a88cd17825cd742caacad",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 134,
    "payload_entropy": 5.166157878118149,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "6ad1c010083e13988cae83ec498fe8405475906d",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "matched_patterns": [
        "pat-0492"
    ],
    "matched_pattern_names": [
        "Cred SSH private key ed25519"
    ],
    "pattern_ids": [
        "pat-0492"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "8943743a71476c9818c2c153552b2940",
        "path_pattern_hash": "e3b000c970b110845a3a2bedb731866f"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "method": "GET",
    "path": "\/ssh\/id_ed25519",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ssh\/id_ed25519 HTTP\/1.1",
    "request_sample": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "evidence": {
        "method": "GET",
        "path": "\/ssh\/id_ed25519",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ssh\/id_ed25519 HTTP\/1.1",
        "request_sample": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "134c555a311baa0119cb43cbefd780a3eab206c5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ssh\/id_ed25519",
        "request_line": "GET \/ssh\/id_ed25519 HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/id_ed25519",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ssh\/id_ed25519",
            "request_line": "GET \/ssh\/id_ed25519 HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ssh\/id_ed25519",
        "evidence_snippet": "GET \/ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "af92294862f77464d7b4d626dc151e9802485f54",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.140599383252936,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "91adfaa5b1f1bcd5ec11b2d3d8edf7a0b3ab1efd",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0495",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0495"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_rsa"
    ],
    "pattern_ids": [
        "pat-0495"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "dea838ba022ab09190cdb0bbbc2f7bce",
        "path_pattern_hash": "fc24aa2aaac8a23a581c87b6f065bec8"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
    "method": "GET",
    "path": "\/ssh\/id_rsa",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ssh\/id_rsa HTTP\/1.1",
    "request_sample": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ssh\/id_rsa",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ssh\/id_rsa HTTP\/1.1",
        "request_sample": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "956e7b7e48a5201cb2a63d3136fa536eb777ce29",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ssh\/id_rsa",
        "request_line": "GET \/ssh\/id_rsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ssh\/id_rsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0495",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ssh\/id_rsa",
            "request_line": "GET \/ssh\/id_rsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ssh\/id_rsa",
        "evidence_snippet": "GET \/ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/authorized_keys2",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "a2433caa98478755f42c1cae3114723362c579f4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 141,
    "payload_entropy": 5.191420943615199,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "d9693b3afdcc7e69fa05bfd887fdf69f919d4cba",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0489",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0489",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0489"
    ],
    "matched_pattern_names": [
        "Cred SSH authorized_keys"
    ],
    "pattern_ids": [
        "pat-0489"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "c6a372fa201028ff479c94119408f2c8",
        "path_pattern_hash": "d694e2a7509bc3838933759730b35668"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "method": "GET",
    "path": "\/.ssh\/authorized_keys2",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/authorized_keys2 HTTP\/1.1",
    "request_sample": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/authorized_keys2",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/authorized_keys2 HTTP\/1.1",
        "request_sample": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3944ac5d38850b99c6544f5c96219b8d9a862eec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/authorized_keys2",
        "request_line": "GET \/.ssh\/authorized_keys2 HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys2",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0489",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0489",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/authorized_keys2",
            "request_line": "GET \/.ssh\/authorized_keys2 HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys2",
        "evidence_snippet": "GET \/.ssh\/authorized_keys2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/authorized_keys",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "a25aaf7c350e380b4697c5b640d5d962e0f1dd91",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 140,
    "payload_entropy": 5.181523105241495,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "c7aa8e193765eb62b735ba155dfa981b73027f53",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0489",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0489",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0489"
    ],
    "matched_pattern_names": [
        "Cred SSH authorized_keys"
    ],
    "pattern_ids": [
        "pat-0489"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "34c7471667e7b47a3659373e96284756",
        "path_pattern_hash": "7cedd4ba646691da0a133647f6b04acc"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "method": "GET",
    "path": "\/.ssh\/authorized_keys",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
    "request_sample": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/authorized_keys",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
        "request_sample": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2decc3a4cd283bed50895258ad3fd9893a532157",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/authorized_keys",
        "request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0489",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0489",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/authorized_keys",
            "request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys",
        "evidence_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/config",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "efd8df31ed9278bd121c9c4bc2eef597d2861bb1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.109060646553021,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "c1fb5444244a26676482d8f140f9c1546287260f",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 115,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6dc80a447be637a0ec8a20864c1f2baa",
        "path_pattern_hash": "9b1a8d58ed26d9a7b60675c7f7459d3e"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/.ssh\/config",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/config HTTP\/1.1",
    "request_sample": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/config",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/config HTTP\/1.1",
        "request_sample": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f66249365852d9a92f8bfb4a40e9e0ecca6092ac",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/config",
        "request_line": "GET \/.ssh\/config HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/config",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/config",
            "request_line": "GET \/.ssh\/config HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/config",
        "evidence_snippet": "GET \/.ssh\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/id_dsa",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c4235a768b1c31a02b4a1843edc90378b730bc53",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.132505021412408,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "ac2c0c1cdabe0279b84d1ffe9b5fadae7b5bd3ee",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0493",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0493",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0493"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_dsa"
    ],
    "pattern_ids": [
        "pat-0493"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "3eab209543287dd6cd9b850903be7c92",
        "path_pattern_hash": "910de4832545616b3d4245313eda6c13"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/.ssh\/id_dsa",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_dsa HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_dsa",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_dsa HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "baab06a1b94906adcf97dd8896d6fc38b2134f4e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_dsa",
        "request_line": "GET \/.ssh\/id_dsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_dsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0493",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0493",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_dsa",
            "request_line": "GET \/.ssh\/id_dsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_dsa",
        "evidence_snippet": "GET \/.ssh\/id_dsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pub",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "aeb55adf5fb7c4220ad271960e9de0a4f6a845f8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.126378190341253,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "63db8ad05ec3ff2328e4e36d591f553c05d55827",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0494",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0494",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0494"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_ecdsa"
    ],
    "pattern_ids": [
        "pat-0494"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f751c57abc6eed4b9b6a39af20ea8a2e",
        "path_pattern_hash": "e5b2721783f0cebaf4fff5fb6870dc0c"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/.ssh\/id_ecdsa.pub",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_ecdsa.pub",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ab658f3a813e00e2e074a16b041d8ebc5c32f327",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_ecdsa.pub",
        "request_line": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ecdsa.pub",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0494",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0494",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_ecdsa.pub",
            "request_line": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ecdsa.pub",
        "evidence_snippet": "GET \/.ssh\/id_ecdsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/id_ecdsa",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "9979a6d4ec6aca197011f08193373d28d95b696e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.118362541800714,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "7d38b9760be3a34d7ec453d75a40bdbf15ecf3d0",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0494",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0494",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0494"
    ],
    "matched_pattern_names": [
        "Cred SSH private key id_ecdsa"
    ],
    "pattern_ids": [
        "pat-0494"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "ff58b8f06bce50e3ef38587aad5a01a9",
        "path_pattern_hash": "9978f84439cb9edc657937e18087a942"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/.ssh\/id_ecdsa",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_ecdsa HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_ecdsa",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_ecdsa HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bc4b164ace5193639bd43f2cb7f524b225beb39b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_ecdsa",
        "request_line": "GET \/.ssh\/id_ecdsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ecdsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0494",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0494",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_ecdsa",
            "request_line": "GET \/.ssh\/id_ecdsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ecdsa",
        "evidence_snippet": "GET \/.ssh\/id_ecdsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pub",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "b576dd76f72e91fb9a7ac84f52b2dcabe672d6a3",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 139,
    "payload_entropy": 5.1693211604208,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "9d0ca82124c83175c37cc25ddffad4df941a7d97",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0492",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0492",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0492"
    ],
    "matched_pattern_names": [
        "Cred SSH private key ed25519"
    ],
    "pattern_ids": [
        "pat-0492"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1869ce4b76cd18f94ff128fd6416e3ef",
        "path_pattern_hash": "875195a6a87d04481638f35555e4d8db"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "method": "GET",
    "path": "\/.ssh\/id_ed25519.pub",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_ed25519.pub",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "507e702f2ef580b98c09b74474e97d2f47141719",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_ed25519.pub",
        "request_line": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ed25519.pub",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0492",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0492",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_ed25519.pub",
            "request_line": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ed25519.pub",
        "evidence_snippet": "GET \/.ssh\/id_ed25519.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 6,
    "http_path_ext": "crt",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f75e2c485d63a8d690603de7512657404a7e0847",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 171,
    "payload_entropy": 5.0172521106211585,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 64,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 64,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "953c2e0b07c5419c5b07601854f8b5e19860c229",
    "event_fingerprint": "861821106886284474756201ab7842db598a1347",
    "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 74,
    "precision_signals": [
        "pat-0656"
    ],
    "kb_rule_ids": [
        "pat-0656"
    ],
    "matched_patterns": [
        "pat-0656"
    ],
    "matched_pattern_names": [
        "K8s SA token path"
    ],
    "pattern_ids": [
        "pat-0656"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1eadeb0e6a376d469d171d9c49e35d86",
        "path_pattern_hash": "2d862f85097fb6729b2b0a089e9794b0"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
    "method": "GET",
    "path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950316:lfi-14",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "nosqli-3"
    ],
    "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1",
    "request_sample": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
    "evidence": {
        "method": "GET",
        "path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950316:lfi-14",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "nosqli-3"
        ],
        "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1",
        "request_sample": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
        "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cloud_infra_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a88b71e00bdf995b45302da476e180663eb00fac",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt",
        "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
    "attack_vector": "kubernetes probe \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/c\u2026",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0656"
        ],
        "tags_summary_labels_fr": [
            "pat-0656"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt",
            "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "kubernetes probe \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/c\u2026",
        "evidence_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950316:lfi-14",
        "950468:nosqli-3",
        "http_k8s_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/id_ed25519",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "306d98c7b24d1b2bfbec725833a0037a5418aa2d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.1620679645812055,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1866a3e731bf73e30a83e7171e6fa76ce11ce96b",
    "event_fingerprint": "d2ab281d2f5e4691c3f32c62a7ddbc9f657fdb02",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0492",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0492",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0492"
    ],
    "matched_pattern_names": [
        "Cred SSH private key ed25519"
    ],
    "pattern_ids": [
        "pat-0492"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1d5b96657ec12f8c0eed40f83c1129c5",
        "path_pattern_hash": "d6c157a7b396f45943e49312666b9456"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/.ssh\/id_ed25519",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_ed25519 HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_ed25519",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_ed25519 HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "160c91fb226513c1ce995fdb3638bc9fb8a9d55c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_ed25519",
        "request_line": "GET \/.ssh\/id_ed25519 HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ed25519",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0492",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0492",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_ed25519",
            "request_line": "GET \/.ssh\/id_ed25519 HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_ed25519",
        "evidence_snippet": "GET \/.ssh\/id_ed25519 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/id_rsa",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d951dfd854ab99392c126a2628ec52b85415a678",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.136247196951897,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "25655d3a579f2ae4b96844f888b073bd38c52aee",
    "event_fingerprint": "7f9a91b69a2655fdfd4d36b4b5d654818348f960",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde cl\u00e9 SSH \/ id_rsa \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 363,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "INT-http_id_rsa",
        "pat-0490",
        "pat-0495",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "INT-http_id_rsa",
        "pat-0490",
        "pat-0495",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0490",
        "pat-0495"
    ],
    "matched_pattern_names": [
        "Cred SSH key in .ssh",
        "Cred SSH private key id_rsa"
    ],
    "pattern_ids": [
        "pat-0490",
        "pat-0495"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "781d3012b11d2794974b4632c42f9e53",
        "path_pattern_hash": "6eca2c923ad05fff3eba197c659999e2"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/.ssh\/id_rsa",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_rsa HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_rsa",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_rsa HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde cl\u00e9 SSH \/ id_rsa \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b4e6831d20df2cd567de891a8cc657571a8db4f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_rsa",
        "request_line": "GET \/.ssh\/id_rsa HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_rsa",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde cl\u00e9 SSH \/ id_rsa \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde cl\u00e9 SSH \/ id_rsa \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "INT-http_id_rsa",
            "pat-0490",
            "pat-0495"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "Http Id Rsa",
            "pat-0490",
            "pat-0495"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_rsa",
            "request_line": "GET \/.ssh\/id_rsa HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_rsa",
        "evidence_snippet": "GET \/.ssh\/id_rsa HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_id_rsa",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "pub",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "2e942f8609e0d1995582a3cc7c7c6bcca70b2d05",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.143213613144287,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "8bb13899cb53e0606b36b249487fe0dc99feb5e3",
    "event_fingerprint": "69d5dd54a073a59d4c27a347f068bbfc3f4dd76e",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 275,
    "precision_signals": [
        "SIGMA-web-credential-file",
        "pat-0490",
        "pat-0495",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-credential-file",
        "pat-0490",
        "pat-0495",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0490",
        "pat-0495"
    ],
    "matched_pattern_names": [
        "Cred SSH key in .ssh",
        "Cred SSH private key id_rsa"
    ],
    "pattern_ids": [
        "pat-0490",
        "pat-0495"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "4e3d9158511feaa738275ccc08e8c3fc",
        "path_pattern_hash": "8c9c8bb564cc502138156bdb3c0731c2"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/.ssh\/id_rsa.pub",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ssh\/id_rsa.pub HTTP\/1.1",
    "request_sample": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/.ssh\/id_rsa.pub",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ssh\/id_rsa.pub HTTP\/1.1",
        "request_sample": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "74f445ae47428c559be8f2608350e01cea84116d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ssh\/id_rsa.pub",
        "request_line": "GET \/.ssh\/id_rsa.pub HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_rsa.pub",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-credential-file",
            "pat-0490",
            "pat-0495",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-credential-file",
            "pat-0490",
            "pat-0495",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ssh\/id_rsa.pub",
            "request_line": "GET \/.ssh\/id_rsa.pub HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/id_rsa.pub",
        "evidence_snippet": "GET \/.ssh\/id_rsa.pub HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_id_rsa_pub",
        "http_sensitive_path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 6,
    "http_path_ext": "io\/serviceaccount\/token",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "a9ffc524f8c48a0c877145afff7426d72a3db001",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 170,
    "payload_entropy": 5.0313754082811215,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 64,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 64,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "eb491d93570f3849dc7a478b87499c0450fe7a0a",
    "event_fingerprint": "b87536582e4bdecfd6d69af9d331b69d56218a99",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 135,
    "precision_signals": [
        "pat-0477",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "pat-0477",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0477",
        "pat-0656"
    ],
    "matched_pattern_names": [
        "Cred Generic token path",
        "K8s SA token path"
    ],
    "pattern_ids": [
        "pat-0477",
        "pat-0656"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "fae2563bb319819e33a889fa1e2ff16f",
        "path_pattern_hash": "ca72b599811baea7d69c597a2cf30c37"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: ",
    "method": "GET",
    "path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950316:lfi-14",
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "nosqli-3"
    ],
    "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1",
    "request_sample": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
    "evidence": {
        "method": "GET",
        "path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950316:lfi-14",
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "nosqli-3"
        ],
        "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1",
        "request_sample": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "da2c3bdd8c0ca28ab5c619c3132d10e672e54fa0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token",
        "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/t\u2026",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0477",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "pat-0477",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token",
            "request_line": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/t\u2026",
        "evidence_snippet": "GET \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950468:nosqli-3",
        "http_k8s_probe",
        "http_oauth_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "7a464709aca7ea1bbe0e610db0ecdc4733ba5559",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 140,
    "payload_entropy": 5.096906057206638,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "44aa7833b444faf4693d272787aa6b59c07757a5",
    "event_fingerprint": "7df81857a3cb255c9e94904436591248eb8014c3",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f4abf4ad19c7a11235b0f29170f0ce1e",
        "path_pattern_hash": "6f58afeda0a22c81fc59b698553f5366"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "method": "GET",
    "path": "\/serviceaccount\/token",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/serviceaccount\/token HTTP\/1.1",
    "request_sample": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "evidence": {
        "method": "GET",
        "path": "\/serviceaccount\/token",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/serviceaccount\/token HTTP\/1.1",
        "request_sample": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%"
    },
    "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "efa2e1242cb6c9e75141b44ebd4ad85a4752fea7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/serviceaccount\/token",
        "request_line": "GET \/serviceaccount\/token HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/serviceaccount\/token",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/serviceaccount\/token",
            "request_line": "GET \/serviceaccount\/token HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/serviceaccount\/token",
        "evidence_snippet": "GET \/serviceaccount\/token HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_oauth_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "1d81a44881acb7660ab7cfd056089d222ea4e20a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.187410801954062,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "fdc5c157bc6036a104cbfd920dcc75d9e7eccb13",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "516e92666c93995d95d7d8a2ad859380",
        "path_pattern_hash": "36469067f94b8858dbc924de9efd940b"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/values.prod.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/values.prod.yaml HTTP\/1.1",
    "request_sample": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/values.prod.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/values.prod.yaml HTTP\/1.1",
        "request_sample": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a677475196102235b401559adbbb8cf407ff83e8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/values.prod.yaml",
        "request_line": "GET \/values.prod.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/values.prod.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/values.prod.yaml",
            "request_line": "GET \/values.prod.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/values.prod.yaml",
        "evidence_snippet": "GET \/values.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d5a29d7ad045d3f66befba65878f8a9d819f5b10",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 142,
    "payload_entropy": 5.163940585155739,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
    "event_fingerprint": "ddd1b5c668c825cc3973335604c53c7cef4d9f82",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "matched_patterns": [
        "pat-0216"
    ],
    "matched_pattern_names": [
        "Probe \/kubernetes\/"
    ],
    "pattern_ids": [
        "pat-0216"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "5fe427cc9ae9003d336f39f7c5c6bf65",
        "path_pattern_hash": "c65e0ff5c4a21e776232713584c12a41"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "method": "GET",
    "path": "\/kubernetes\/config.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/kubernetes\/config.yaml HTTP\/1.1",
    "request_sample": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "evidence": {
        "method": "GET",
        "path": "\/kubernetes\/config.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/kubernetes\/config.yaml HTTP\/1.1",
        "request_sample": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "62f1e0c9326c0f6690ca74229f5cad3c9ede808f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubernetes\/config.yaml",
        "request_line": "GET \/kubernetes\/config.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/config.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubernetes\/config.yaml",
            "request_line": "GET \/kubernetes\/config.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/config.yaml",
        "evidence_snippet": "GET \/kubernetes\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "config\/kube\/config",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "9ce82ab859fd5643c484a47708def9684bca1332",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 139,
    "payload_entropy": 5.114992966289195,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "ea07d8a0574eba48193262dd39ccc20781e6b80b",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "53b11569fe90e0f708986f6342e263e5",
        "path_pattern_hash": "2b3037eb23031a449bb632364df424d5"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "method": "GET",
    "path": "\/.config\/kube\/config",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.config\/kube\/config HTTP\/1.1",
    "request_sample": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "evidence": {
        "method": "GET",
        "path": "\/.config\/kube\/config",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.config\/kube\/config HTTP\/1.1",
        "request_sample": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6866f41bdc5f7610dfa4896398a65be6f40fff65",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.config\/kube\/config",
        "request_line": "GET \/.config\/kube\/config HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/kube\/config",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.config\/kube\/config",
            "request_line": "GET \/.config\/kube\/config HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/kube\/config",
        "evidence_snippet": "GET \/.config\/kube\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "676d0a92e3e032f873c3dec95ecff1e17931ece2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.2123629379590035,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
    "event_fingerprint": "40b6177517e013be1640204f19a79f542ea679d6",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6afbce655c548320d4d2f7dbd68a327c",
        "path_pattern_hash": "bcc8ae83b0d8fbcf7e11997fb57921fb"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/k8s\/config.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/k8s\/config.yaml HTTP\/1.1",
    "request_sample": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/k8s\/config.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/k8s\/config.yaml HTTP\/1.1",
        "request_sample": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "63093ad4b6ff130cd7434027dd6e0e4e690754bb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/k8s\/config.yaml",
        "request_line": "GET \/k8s\/config.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/config.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/k8s\/config.yaml",
            "request_line": "GET \/k8s\/config.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/config.yaml",
        "evidence_snippet": "GET \/k8s\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "aa2f2425e3b1bb721b03e38d049621c2f8ba7ed1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.182506195598217,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 51,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "5f61dd631f03aef151ccadfba9f26441de08d9cb",
    "event_fingerprint": "5b944aa95e325f0e279ddcaab205a6782f69cde8",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
    "confidence": 0.97,
    "classification_confidence": 0.97,
    "precision_score": 105,
    "precision_signals": [
        "pat-0497",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0497",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0497"
    ],
    "matched_pattern_names": [
        "Cred Secrets YAML"
    ],
    "pattern_ids": [
        "pat-0497"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 51
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "e63d87b5307b750f9f6ce1d623321edd",
        "path_pattern_hash": "5bac7f8acf5f162b690a9c420daf93ac"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 51
    },
    "payload_preview": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/k8s\/secrets.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/k8s\/secrets.yml HTTP\/1.1",
    "request_sample": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/k8s\/secrets.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/k8s\/secrets.yml HTTP\/1.1",
        "request_sample": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8559817bdba3d35863590a5e45c40fb4cd3b34a1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/k8s\/secrets.yml",
        "request_line": "GET \/k8s\/secrets.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/secrets.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
        "confidence_pct": 97,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 51
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 51,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0497",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0497",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/k8s\/secrets.yml",
            "request_line": "GET \/k8s\/secrets.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/secrets.yml",
        "evidence_snippet": "GET \/k8s\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_k8s_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "4786b35733f581858d486b5cde49f61a04d34f5e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 142,
    "payload_entropy": 5.127003173199144,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 82,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 51,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "5f61dd631f03aef151ccadfba9f26441de08d9cb",
    "event_fingerprint": "fc33191f6e329bffe21b5d513be143fb4955e54f",
    "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
    "confidence": 0.97,
    "classification_confidence": 0.97,
    "precision_score": 105,
    "precision_signals": [
        "pat-0497",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0497",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0497",
        "pat-0216"
    ],
    "matched_pattern_names": [
        "Cred Secrets YAML",
        "Probe \/kubernetes\/"
    ],
    "pattern_ids": [
        "pat-0497",
        "pat-0216"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 82,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 51
    },
    "named_classification_skipped": false,
    "classification_parent": "lfi_attack",
    "service_name": "http",
    "risk_confidence_factor": 97,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1bfa7efd1bf6d92d3d8d6c49278eab4a",
        "path_pattern_hash": "d992ac7bee60eed6a7cf5bc87ecefb22"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 51
    },
    "payload_preview": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "method": "GET",
    "path": "\/kubernetes\/secrets.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/kubernetes\/secrets.yml HTTP\/1.1",
    "request_sample": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "evidence": {
        "method": "GET",
        "path": "\/kubernetes\/secrets.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/kubernetes\/secrets.yml HTTP\/1.1",
        "request_sample": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3ce084492477ca05b20248e000a12ac9a1808ccc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubernetes\/secrets.yml",
        "request_line": "GET \/kubernetes\/secrets.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/kubernetes\/secrets.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
        "confidence_pct": 97,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 82,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 51
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 51,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0497",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0497",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubernetes\/secrets.yml",
            "request_line": "GET \/kubernetes\/secrets.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "credential file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/kubernetes\/secrets.yml",
        "evidence_snippet": "GET \/kubernetes\/secrets.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "http_k8s_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ffb8a2a56035118c8acfb3d351a6ffcf5d9c7322",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 142,
    "payload_entropy": 5.127003173199145,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c6ca70932b0a1e82f0d7dacd6f35dc6a616b5384",
    "event_fingerprint": "d506a7e04cb50a62d125e9b37d9736082a4382a3",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "matched_patterns": [
        "pat-0216"
    ],
    "matched_pattern_names": [
        "Probe \/kubernetes\/"
    ],
    "pattern_ids": [
        "pat-0216"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "1701a7d6fc49b3878b54257d73d8f326",
        "path_pattern_hash": "88fd148eb181493ffac8757e3bff9abb"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "method": "GET",
    "path": "\/kubernetes\/secret.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/kubernetes\/secret.yaml HTTP\/1.1",
    "request_sample": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "evidence": {
        "method": "GET",
        "path": "\/kubernetes\/secret.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/kubernetes\/secret.yaml HTTP\/1.1",
        "request_sample": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "de6823119c385348c915e171c92688a873da8fcd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubernetes\/secret.yaml",
        "request_line": "GET \/kubernetes\/secret.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secret.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubernetes\/secret.yaml",
            "request_line": "GET \/kubernetes\/secret.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secret.yaml",
        "evidence_snippet": "GET \/kubernetes\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d951e91592864131896543d9d10a69f30b85267d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 144,
    "payload_entropy": 5.167840718672298,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
    "event_fingerprint": "fd4887632b98347ffced345ab3eef89e456f80a5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "29028b2b26cc468229a25747f14a5c4d",
        "path_pattern_hash": "79092f34fd3fc821ff18c5e98538f18e"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "method": "GET",
    "path": "\/.config\/kube\/config.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.config\/kube\/config.yaml HTTP\/1.1",
    "request_sample": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "evidence": {
        "method": "GET",
        "path": "\/.config\/kube\/config.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.config\/kube\/config.yaml HTTP\/1.1",
        "request_sample": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "831f242265c003ba0ebc7c015848f9953676bbbd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.config\/kube\/config.yaml",
        "request_line": "GET \/.config\/kube\/config.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/kube\/config.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.config\/kube\/config.yaml",
            "request_line": "GET \/.config\/kube\/config.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/kube\/config.yaml",
        "evidence_snippet": "GET \/.config\/kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "4dc98ff79a0692a9bfc53264c59fbd2c66cbfa26",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.11019640689941,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "0e80f120a05b685d846041a2599dc748ceb9bdcd",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "884573c923d35c8b8d8284930ae93606",
        "path_pattern_hash": "87e152cecbaa9193bcff7553bc401193"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/talosconfig",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/talosconfig HTTP\/1.1",
    "request_sample": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/talosconfig",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/talosconfig HTTP\/1.1",
        "request_sample": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e276aa4ec15624370873c4ea2f3ed548a744fc72",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/talosconfig",
        "request_line": "GET \/talosconfig HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/talosconfig",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/talosconfig",
            "request_line": "GET \/talosconfig HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/talosconfig",
        "evidence_snippet": "GET \/talosconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 4,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ba6ba6fe109fb10a7bd584dc784d613c62acc220",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 144,
    "payload_entropy": 5.1520753857603765,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "e6334a05771a8957eac1c48c9e60e72183f76c36",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f67f0c6be5046868ac26ead98a0b6c51",
        "path_pattern_hash": "edbcd4d5873a824f1fb7cb8e0b53ca0b"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "method": "GET",
    "path": "\/etc\/rancher\/k3s\/k3s.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1",
    "request_sample": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/rancher\/k3s\/k3s.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1",
        "request_sample": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "15e23c9d81292d5b9cfadf7885d7be827f44a346",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/rancher\/k3s\/k3s.yaml",
        "request_line": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/rancher\/k3s\/k3s.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/rancher\/k3s\/k3s.yaml",
            "request_line": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/rancher\/k3s\/k3s.yaml",
        "evidence_snippet": "GET \/etc\/rancher\/k3s\/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "3c4222ad696ce7d61e5dab7214c379c47228713c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.189545786392662,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "a6a1c082d8c2cbaf3fadfc01b89301bf4bf74641",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "03da8093b4ee367430a845e202f3253b",
        "path_pattern_hash": "2d0c225dc0a628d05f78ea8c40605051"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/kubeconfig.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/kubeconfig.yaml HTTP\/1.1",
    "request_sample": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/kubeconfig.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/kubeconfig.yaml HTTP\/1.1",
        "request_sample": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf352eed2bd915a954e985d7a21f4a0252ee9cc7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubeconfig.yaml",
        "request_line": "GET \/kubeconfig.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubeconfig.yaml",
            "request_line": "GET \/kubeconfig.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig.yaml",
        "evidence_snippet": "GET \/kubeconfig.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "e24bf342d3aedddc0270bd678f1ea93a3f3bbdc3",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.153274697857553,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "8413a0cbcc087534b324d25fd37cc49cff1524f3",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "9f74d8c725e0660daa8707139f7b4df9",
        "path_pattern_hash": "2724720adfab6a5d5d5002426507e4fe"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/kubeconfig.json",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/kubeconfig.json HTTP\/1.1",
    "request_sample": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/kubeconfig.json",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/kubeconfig.json HTTP\/1.1",
        "request_sample": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5ddb89a5af022e318e8cd32438e849203e4ca212",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubeconfig.json",
        "request_line": "GET \/kubeconfig.json HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig.json",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubeconfig.json",
            "request_line": "GET \/kubeconfig.json HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig.json",
        "evidence_snippet": "GET \/kubeconfig.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d9fb2f2fbc2bd2bb847a6a91cd9eb102034c3cfa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 128,
    "payload_entropy": 5.189054887128853,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "80939e0d0f9b837c78e58b9a2ce01790de23fad1",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "c4fc51b2551259572dc4c6cd785d7120",
        "path_pattern_hash": "b902486cb5a46edc38e7e9a149f9155c"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/k3s.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/k3s.yaml HTTP\/1.1",
    "request_sample": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/k3s.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/k3s.yaml HTTP\/1.1",
        "request_sample": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "03d10ea40459ad6586492dfb558dbe609ce36249",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/k3s.yaml",
        "request_line": "GET \/k3s.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k3s.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/k3s.yaml",
            "request_line": "GET \/k3s.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k3s.yaml",
        "evidence_snippet": "GET \/k3s.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c25526e59f9adaafaad288aa731a580dc70796c0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.135662817378254,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "f805ecdf4b131aa63e667b93b53f5b95786f2baa",
    "event_fingerprint": "ee3b3110d790949546f562053e029727ef69033d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f3fbe6878442e616dabe47e686708108",
        "path_pattern_hash": "b8541430f0d6926b3ead8741fa0df259"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
    "method": "GET",
    "path": "\/kubeconfig",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/kubeconfig HTTP\/1.1",
    "request_sample": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/kubeconfig",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/kubeconfig HTTP\/1.1",
        "request_sample": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6f6c701413897809da56c10817adaefd3210409",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/kubeconfig",
        "request_line": "GET \/kubeconfig HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/kubeconfig",
            "request_line": "GET \/kubeconfig HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubeconfig",
        "evidence_snippet": "GET \/kubeconfig HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_probe_kubeconfig"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "8ee699645f0f80d8927f9d2ee4ad21a5abbb6e37",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.181734459870259,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
    "event_fingerprint": "78460f9cf5623e0d98c6492b855f8ff0ab16a05f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "matched_patterns": [
        "pat-0593",
        "pat-0203"
    ],
    "matched_pattern_names": [
        "ET .kube\/config",
        "Probe \/.kube\/config"
    ],
    "pattern_ids": [
        "pat-0593",
        "pat-0203"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "4a7f0b73592c6fb832190b210c728c9c",
        "path_pattern_hash": "96b524334d865c4c1699ac1d1d7b3199"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/.kube\/config.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.kube\/config.yaml HTTP\/1.1",
    "request_sample": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/.kube\/config.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.kube\/config.yaml HTTP\/1.1",
        "request_sample": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ca33bbbb6bccda4d39d4badedd0fbd3368185f2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.kube\/config.yaml",
        "request_line": "GET \/.kube\/config.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.kube\/config.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.kube\/config.yaml",
            "request_line": "GET \/.kube\/config.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.kube\/config.yaml",
        "evidence_snippet": "GET \/.kube\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c407cb0f7133ce88b32362ed3c52a1f1b52f9f9b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.145992876277268,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714",
    "event_fingerprint": "dd08e91325dce70838c8a0067d24ec9ed05638c5",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 152,
    "precision_signals": [
        "INT-http_sensitive",
        "pat-0203",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "pat-0203",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0593",
        "pat-0203"
    ],
    "matched_pattern_names": [
        "ET .kube\/config",
        "Probe \/.kube\/config"
    ],
    "pattern_ids": [
        "pat-0593",
        "pat-0203"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 74,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 47
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6f8590d935431df352bf258a42b2ba14",
        "path_pattern_hash": "70761157547eb066d304465311323c13"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/.kube\/config.json",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.kube\/config.json HTTP\/1.1",
    "request_sample": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/.kube\/config.json",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.kube\/config.json HTTP\/1.1",
        "request_sample": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e3826ed8432bb1f4fa507a21298314d6c30a4503",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.kube\/config.json",
        "request_line": "GET \/.kube\/config.json HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.kube\/config.json",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 74,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 47
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "pat-0203",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "pat-0203",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.kube\/config.json",
            "request_line": "GET \/.kube\/config.json HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.kube\/config.json",
        "evidence_snippet": "GET \/.kube\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_sensitive_path"
    ]
}