161.118.232.74

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "100739ddb05bec6e0d4630b6e717308cacf94df7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.148673693352151,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "819f4a084e3c76dd41da66b7655757188b195ed1",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "839f296572bdb33ba2992d4f05109e54",
        "path_pattern_hash": "5fb5b64195e61b71f3500cfe432f337c"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/compose.prod.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/compose.prod.yaml HTTP\/1.1",
    "request_sample": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/compose.prod.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/compose.prod.yaml HTTP\/1.1",
        "request_sample": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "63ae6fec36f57291bf2d619ad1dd4d6e8243667f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/compose.prod.yaml",
        "request_line": "GET \/compose.prod.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/compose.prod.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/compose.prod.yaml",
            "request_line": "GET \/compose.prod.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/compose.prod.yaml",
        "evidence_snippet": "GET \/compose.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "cfg",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "7ef1b826e14d936c950d88810f2a46ee4893ec58",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.107535982887221,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "f1ce3d448d31ed350f44de5949ff52d6c592f88c",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "670c571da1ff344c368517409a34349c",
        "path_pattern_hash": "e8f0b37cf3a2892b02b9e2f15115f616"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/ansible.cfg",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/ansible.cfg HTTP\/1.1",
    "request_sample": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ansible.cfg",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/ansible.cfg HTTP\/1.1",
        "request_sample": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3893529585f165cd8ee8a5ed312d813611ac8211",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible.cfg",
        "request_line": "GET \/ansible.cfg HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible.cfg",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible.cfg",
            "request_line": "GET \/ansible.cfg HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible.cfg",
        "evidence_snippet": "GET \/ansible.cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "6e7bb020beba54b55dd89f3dbb128b5a04db9b6f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 138,
    "payload_entropy": 5.14905288181952,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "e32e1bcec1ec6ea838e4006dc5d41ee69e8befd2",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "628a62dfe0a82ea96ab3460798c5149b",
        "path_pattern_hash": "f129877cdc1559e591f96a0e0ef757df"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
    "method": "GET",
    "path": "\/ansible\/hosts.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/hosts.yaml HTTP\/1.1",
    "request_sample": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/hosts.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/hosts.yaml HTTP\/1.1",
        "request_sample": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2640cb718fe0ddacb53a516e2f4690a6457f389b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/hosts.yaml",
        "request_line": "GET \/ansible\/hosts.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/hosts.yaml",
            "request_line": "GET \/ansible\/hosts.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts.yaml",
        "evidence_snippet": "GET \/ansible\/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "e7b386a66ed12a49fc811c2db636336c1b35fea8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.152725931030572,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "9725374e1300c867105b0d7212ab2c2ea63405a4",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "9d4060cf820b354835acba414ba8ded4",
        "path_pattern_hash": "3a64d59cbb8211b92a1a09b7395c38e1"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/ansible\/hosts.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/hosts.yml HTTP\/1.1",
    "request_sample": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/hosts.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/hosts.yml HTTP\/1.1",
        "request_sample": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "125f1c18366e5bdd17e93fb597ec7ae28a7a0eec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/hosts.yml",
        "request_line": "GET \/ansible\/hosts.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/hosts.yml",
            "request_line": "GET \/ansible\/hosts.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts.yml",
        "evidence_snippet": "GET \/ansible\/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "98a1bbbbc2e5ceb59c7cfb8c335d499b23be6c2c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.101508595032396,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "f0975e0242b91074cc344496f30611cc2492d832",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "714a747afd75f802eb2ea5d6e51d50cf",
        "path_pattern_hash": "5dd5bcf54580f0d79e3d7aa0b3330f3a"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/ansible\/hosts",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/hosts HTTP\/1.1",
    "request_sample": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/hosts",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/hosts HTTP\/1.1",
        "request_sample": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "350fb261d289ba3b83e455095079fe23cb60d7f2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/hosts",
        "request_line": "GET \/ansible\/hosts HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/hosts",
            "request_line": "GET \/ansible\/hosts HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/hosts",
        "evidence_snippet": "GET \/ansible\/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "a34bf766924327b5e62479587ef983ac83e78f43",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.1612702445855065,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "2ce0bddf6d8ac6dd53430f8579fd8b5765c4720a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "60690d712aef26d5c09a5099abf39f33",
        "path_pattern_hash": "5e8d858e8ba02f0ea9ee52d2a8122d20"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
    "method": "GET",
    "path": "\/hosts.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/hosts.yaml HTTP\/1.1",
    "request_sample": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/hosts.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/hosts.yaml HTTP\/1.1",
        "request_sample": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "342204fbb370c3104fde71be4bbac60772c12cef",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/hosts.yaml",
        "request_line": "GET \/hosts.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/hosts.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/hosts.yaml",
            "request_line": "GET \/hosts.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/hosts.yaml",
        "evidence_snippet": "GET \/hosts.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "7f38b5e3484358d9ea2302d3410cd9bf33b42f2e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 129,
    "payload_entropy": 5.163684283150798,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "ec2f27c059c4591dce8c87292b8da054cd17a868",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "da8ea697d8d728702684cb7f622ad069",
        "path_pattern_hash": "25674f2e3e13f10eb87ce0e76337ef1d"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
    "method": "GET",
    "path": "\/hosts.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/hosts.yml HTTP\/1.1",
    "request_sample": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/hosts.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/hosts.yml HTTP\/1.1",
        "request_sample": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "354bd3cb1a8dd84d6fac575a90d6a11a0417f389",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/hosts.yml",
        "request_line": "GET \/hosts.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/hosts.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/hosts.yml",
            "request_line": "GET \/hosts.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/hosts.yml",
        "evidence_snippet": "GET \/hosts.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "40de093fc0539a35fb923790f37bcafcb107b03f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 134,
    "payload_entropy": 5.1711668299258395,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "617fe8e5a638635ba269f6f779994a3cc07627ab",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "b8a6870370a264dd765b573adeb507ee",
        "path_pattern_hash": "4bc76ff0f0cfacc465d05c6126c8f6b6"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "method": "GET",
    "path": "\/inventory.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/inventory.yaml HTTP\/1.1",
    "request_sample": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "evidence": {
        "method": "GET",
        "path": "\/inventory.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/inventory.yaml HTTP\/1.1",
        "request_sample": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "92d96105c980180f14b78af98863c2f5458fad13",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/inventory.yaml",
        "request_line": "GET \/inventory.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/inventory.yaml",
            "request_line": "GET \/inventory.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.yaml",
        "evidence_snippet": "GET \/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "87fa338b455b27a7e433d1a468bd3f1726961c72",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 5.106321013516038,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "74b4a3f8078104b4e9ab5fecb5f5d40690fa382e",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "a678387851e112159cc19a190d75c00e",
        "path_pattern_hash": "097b87b1c1e9dbae99422a79a107735f"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/hosts",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/hosts HTTP\/1.1",
    "request_sample": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/hosts",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/hosts HTTP\/1.1",
        "request_sample": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7a9b09c8b241b4335174e7ab187e563e59f23ae7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/hosts",
        "request_line": "GET \/hosts HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/hosts",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/hosts",
            "request_line": "GET \/hosts HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/hosts",
        "evidence_snippet": "GET \/hosts HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "32c5fa6c662404fc2830c8bd9bfe5ada0040904b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.173252692367038,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "c07f568c8bf1a3e27ab5046171792b379f04f415",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "10c8d8f616451d62a29c8f5ae5fb8817",
        "path_pattern_hash": "7ca85623e792f32b0f24c0947e157616"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/inventory.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/inventory.yml HTTP\/1.1",
    "request_sample": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/inventory.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/inventory.yml HTTP\/1.1",
        "request_sample": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5662644f12f1866bb7764fb0647691c90826ac30",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/inventory.yml",
        "request_line": "GET \/inventory.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/inventory.yml",
            "request_line": "GET \/inventory.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.yml",
        "evidence_snippet": "GET \/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ini",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f5de5ddb174253608e7e5c179f2049a40e76d591",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.114167801014228,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "d4b766b75f713bdddef6c215838d7327192ed68f",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "97f17bab6be0f52c25f1d0b69c1501e1",
        "path_pattern_hash": "40a1de4faea37211c3a7aed56f468093"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/inventory.ini",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/inventory.ini HTTP\/1.1",
    "request_sample": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/inventory.ini",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/inventory.ini HTTP\/1.1",
        "request_sample": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "772115d30e50037b4bdaf91b9953de5a0eef432a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/inventory.ini",
        "request_line": "GET \/inventory.ini HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.ini",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/inventory.ini",
            "request_line": "GET \/inventory.ini HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory.ini",
        "evidence_snippet": "GET \/inventory.ini HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "3a9582c0982eaeae037b430783d540f6cda458bb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 142,
    "payload_entropy": 5.160404466699987,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "e77c1a3e4d0a551595e5afa459b38b66bfd8a9d5",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f142685c9831af2673c9e977353c0d30",
        "path_pattern_hash": "e9a7d36823a17083fde75cf482e497ed"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 24
    },
    "payload_preview": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "method": "GET",
    "path": "\/ansible\/inventory.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/inventory.yaml HTTP\/1.1",
    "request_sample": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/inventory.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/inventory.yaml HTTP\/1.1",
        "request_sample": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cc2f0d519bbb24a28cf49d9b462a872fcee12733",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/inventory.yaml",
        "request_line": "GET \/ansible\/inventory.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "attack_vector": "probe ansible \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ansible\/inventory.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/inventory.yaml",
            "request_line": "GET \/ansible\/inventory.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "probe ansible \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ansible\/inventory.yaml",
        "evidence_snippet": "GET \/ansible\/inventory.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ece2beb9b8f420c229c619c8ac29c39c3c92fd3c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 129,
    "payload_entropy": 5.13208135381897,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "d1da33024dda814daeb3652a12582b981a0fd198",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "affa694985acbb261c7c2e180d0e6d2a",
        "path_pattern_hash": "63fbca3170c25d878fdc3ea58fece864"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
    "method": "GET",
    "path": "\/inventory",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/inventory HTTP\/1.1",
    "request_sample": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/inventory",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/inventory HTTP\/1.1",
        "request_sample": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b030b1ec25cfc9b926720e5fa8ee4a00bb3f05f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/inventory",
        "request_line": "GET \/inventory HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/inventory",
            "request_line": "GET \/inventory HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/inventory",
        "evidence_snippet": "GET \/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "8090cd020b1de163eb6eeea12a692ae6928e481a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 141,
    "payload_entropy": 5.163760415034418,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "e79fd9335dbaaccfce665ec2b4ec78f05e0ee446",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "c97c0f985d3414e1bf5d629125cbc90d",
        "path_pattern_hash": "472f261230ff838cf774831ef28ddec1"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 24
    },
    "payload_preview": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "method": "GET",
    "path": "\/ansible\/inventory.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/inventory.yml HTTP\/1.1",
    "request_sample": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/inventory.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/inventory.yml HTTP\/1.1",
        "request_sample": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "567f2856355ad5a754ed492eb8f4422292a38224",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/inventory.yml",
        "request_line": "GET \/ansible\/inventory.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
    "attack_vector": "probe ansible \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ansible\/inventory.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/inventory.yml",
            "request_line": "GET \/ansible\/inventory.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "probe ansible \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ansible\/inventory.yml",
        "evidence_snippet": "GET \/ansible\/inventory.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "940c99e17eeb30ad90fe7135e0c49f857430dd49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 137,
    "payload_entropy": 5.127729162257436,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f",
    "event_fingerprint": "ae6a290cb05d0f6de4fe01c72f38d34b900389ef",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "e68cd919138aa5e94026d7bfb46c50bc",
        "path_pattern_hash": "26506fa225df7ba3b9531ecc2fbc7e91"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "method": "GET",
    "path": "\/ansible\/inventory",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ansible\/inventory HTTP\/1.1",
    "request_sample": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "evidence": {
        "method": "GET",
        "path": "\/ansible\/inventory",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ansible\/inventory HTTP\/1.1",
        "request_sample": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "958d30664f911865a6be4c7f39921bfe4be825f8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ansible\/inventory",
        "request_line": "GET \/ansible\/inventory HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/inventory",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ansible\/inventory",
            "request_line": "GET \/ansible\/inventory HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/inventory",
        "evidence_snippet": "GET \/ansible\/inventory HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "http_probe_ansible"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "hcl",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "340da0c6b1331323c361797e82549dbb24711e20",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 143,
    "payload_entropy": 5.119418211342518,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "cef934d7a9b009d1a0e72c7836058e8a64859569",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6ffdcbaceb823e1363a607c1277f2abf",
        "path_pattern_hash": "67d0beaa0f9dc25a3f3536cc3f249405"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "method": "GET",
    "path": "\/.config\/nomad\/nomad.hcl",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1",
    "request_sample": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "evidence": {
        "method": "GET",
        "path": "\/.config\/nomad\/nomad.hcl",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1",
        "request_sample": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a0a40e722c5774367c2c1d290ebb0b7708f35ff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.config\/nomad\/nomad.hcl",
        "request_line": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/nomad\/nomad.hcl",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.config\/nomad\/nomad.hcl",
            "request_line": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/nomad\/nomad.hcl",
        "evidence_snippet": "GET \/.config\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "hcl",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f351ade9b17193a8a6d3213ec705b44e7479be04",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.1296869419684095,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "5acf24afe882c035151e95f2166454135c99f4ce",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "e5f85887e9940a31c5acfcb68dadfded",
        "path_pattern_hash": "fd0446ad8dfe6ac4d1c06eeb594a63e8"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/nomad\/nomad.hcl",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/nomad\/nomad.hcl HTTP\/1.1",
    "request_sample": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/nomad\/nomad.hcl",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/nomad\/nomad.hcl HTTP\/1.1",
        "request_sample": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3eaac79a7c90947589a86ecc80a23381328e6cda",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/nomad\/nomad.hcl",
        "request_line": "GET \/nomad\/nomad.hcl HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/nomad\/nomad.hcl",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/nomad\/nomad.hcl",
            "request_line": "GET \/nomad\/nomad.hcl HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/nomad\/nomad.hcl",
        "evidence_snippet": "GET \/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "hcl",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "279b9626030e456669e8ac10290080c44cb17b05",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 139,
    "payload_entropy": 5.106452743212266,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "0f6d13e6bcc98daa7ded254fe00bdfdd66bf6b9b",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "3c8a3794537ec08af7a4bf63470ab86c",
        "path_pattern_hash": "af669cc7dea01c5541c346a236f3a3b2"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "method": "GET",
    "path": "\/etc\/nomad\/nomad.hcl",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1",
    "request_sample": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/nomad\/nomad.hcl",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1",
        "request_sample": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4368f9195e78ca13218f7cbd8522bda5ec24fc35",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/nomad\/nomad.hcl",
        "request_line": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/nomad\/nomad.hcl",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/nomad\/nomad.hcl",
            "request_line": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/nomad\/nomad.hcl",
        "evidence_snippet": "GET \/etc\/nomad\/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ffc216378121f2050af38d49e62172729d287d0f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 154,
    "payload_entropy": 5.190917240325962,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "342d7d3d541aded21eba99ae37b3e4abdcb3f8d2",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "20f4772bb74f5320f2f24025631b90ee",
        "path_pattern_hash": "e22ec89a7540a14a560ff44307322a29"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r",
    "method": "GET",
    "path": "\/jupyter\/jupyter_server_config.json",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1",
    "request_sample": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "evidence": {
        "method": "GET",
        "path": "\/jupyter\/jupyter_server_config.json",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1",
        "request_sample": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b89b735c730244f39c738cc7a2364f9e3916b90",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/jupyter\/jupyter_server_config.json",
        "request_line": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter\/jupyter_server_config.json",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/jupyter\/jupyter_server_config.json",
            "request_line": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter\/jupyter_server_config.json",
        "evidence_snippet": "GET \/jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "hcl",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "e687deb00b97075d94c036b6a873bd0e212586b8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 129,
    "payload_entropy": 5.1324975576755705,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "b21c0197a3cdbf44cd67db0ab284321dcbc6e2c1",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "36283cf3b06537b1e27579aac634092c",
        "path_pattern_hash": "698c71c0930e41699da495279212aa94"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
    "method": "GET",
    "path": "\/nomad.hcl",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/nomad.hcl HTTP\/1.1",
    "request_sample": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/nomad.hcl",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/nomad.hcl HTTP\/1.1",
        "request_sample": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "39fe53102a2b5330addaa777970db20eeabb6f0d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/nomad.hcl",
        "request_line": "GET \/nomad.hcl HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/nomad.hcl",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/nomad.hcl",
            "request_line": "GET \/nomad.hcl HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/nomad.hcl",
        "evidence_snippet": "GET \/nomad.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "py",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "8b040b9fddf88b89caae26649963184c58d6f09b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 153,
    "payload_entropy": 5.185683079721275,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "e01648a0f0bee08b65c678f9468008c62cde3194",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "fd1c50649cfb5c8a20970182f5223b1f",
        "path_pattern_hash": "a13f53f874f5699149a23bf40191c5d9"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\n",
    "method": "GET",
    "path": "\/.jupyter\/jupyter_server_config.py",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1",
    "request_sample": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "evidence": {
        "method": "GET",
        "path": "\/.jupyter\/jupyter_server_config.py",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1",
        "request_sample": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "08c63127991b835d913b88f42813978118b86f40",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.jupyter\/jupyter_server_config.py",
        "request_line": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.py",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.jupyter\/jupyter_server_config.py",
            "request_line": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.py",
        "evidence_snippet": "GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d1e6a578c24c77bf5a34563bdab0e274a73af85c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 155,
    "payload_entropy": 5.186927103939443,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "0c42d97cc44ac06b1e9d06b50e2abee4564c6e9e",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "03424d61da6e2d60048edbbce7f8ea8e",
        "path_pattern_hash": "d0844b5ee056c15f009c73533a9e2db3"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "method": "GET",
    "path": "\/.jupyter\/jupyter_server_config.json",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1",
    "request_sample": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "evidence": {
        "method": "GET",
        "path": "\/.jupyter\/jupyter_server_config.json",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1",
        "request_sample": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3f717dfb76328cc52a7735fe28ee2eaeae4be11c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.jupyter\/jupyter_server_config.json",
        "request_line": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.json",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.jupyter\/jupyter_server_config.json",
            "request_line": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.json",
        "evidence_snippet": "GET \/.jupyter\/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "766c90afc3103b5cc2ddcea89ab8ad6046359fa1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 142,
    "payload_entropy": 5.228638409153579,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "94db6c4881e87bfe84d6dd90e279370f807557b5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "5b188551705de71c148f5c9171aa0bb7",
        "path_pattern_hash": "e7dc5510dfa8ea3620d1b464c9485ee6"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "method": "GET",
    "path": "\/jupyterhub_config.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/jupyterhub_config.yaml HTTP\/1.1",
    "request_sample": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "evidence": {
        "method": "GET",
        "path": "\/jupyterhub_config.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/jupyterhub_config.yaml HTTP\/1.1",
        "request_sample": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "314e3bcd048c58ee0ba06e902e02a84bc03b497b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/jupyterhub_config.yaml",
        "request_line": "GET \/jupyterhub_config.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyterhub_config.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/jupyterhub_config.yaml",
            "request_line": "GET \/jupyterhub_config.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyterhub_config.yaml",
        "evidence_snippet": "GET \/jupyterhub_config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "py",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "a1e83f4279c8dd5063e27caf7cdec6d82a2cbd67",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 140,
    "payload_entropy": 5.192940653192754,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "331e44805dcb11c99f0a87f43511bb7b8c72515f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "003d43e19956a946b6037f73fdac146c",
        "path_pattern_hash": "09f9a5de4f057249024e87ec1bd50d10"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "method": "GET",
    "path": "\/jupyterhub_config.py",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/jupyterhub_config.py HTTP\/1.1",
    "request_sample": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "evidence": {
        "method": "GET",
        "path": "\/jupyterhub_config.py",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/jupyterhub_config.py HTTP\/1.1",
        "request_sample": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "818bc0ecb11f2ce77b76da86f0d3e705b9f6e89d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/jupyterhub_config.py",
        "request_line": "GET \/jupyterhub_config.py HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyterhub_config.py",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/jupyterhub_config.py",
            "request_line": "GET \/jupyterhub_config.py HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyterhub_config.py",
        "evidence_snippet": "GET \/jupyterhub_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "py",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "33f298dada22d0bf7c1da8ef390179d5e1e784ab",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 144,
    "payload_entropy": 5.196083487879563,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "9f7bbe5f89f36a7f2459522a4b6fb19932fd0949",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "bbb1a41aede026b9eb7a3b41c9014549",
        "path_pattern_hash": "3ddac9c80974f3121d949503a3c577ae"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "method": "GET",
    "path": "\/jupyter_server_config.py",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/jupyter_server_config.py HTTP\/1.1",
    "request_sample": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "evidence": {
        "method": "GET",
        "path": "\/jupyter_server_config.py",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/jupyter_server_config.py HTTP\/1.1",
        "request_sample": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "592835e5591eb00918735a304e6706724bd4a54d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/jupyter_server_config.py",
        "request_line": "GET \/jupyter_server_config.py HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter_server_config.py",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/jupyter_server_config.py",
            "request_line": "GET \/jupyter_server_config.py HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter_server_config.py",
        "evidence_snippet": "GET \/jupyter_server_config.py HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "1d4247dfbfa4a967d52b38d47f828da831ef85a4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.164283985573719,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "789086247486edc85c082a32c88a962281e03621",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "16d310d99a83db7898e8e1468dfefb65",
        "path_pattern_hash": "9b639cfcb0da741dfadf8a4c571d8062"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/ray\/cluster.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/ray\/cluster.yaml HTTP\/1.1",
    "request_sample": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/ray\/cluster.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/ray\/cluster.yaml HTTP\/1.1",
        "request_sample": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "95bf1e8f106cccc2a0a2edab677a7aeecacee374",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ray\/cluster.yaml",
        "request_line": "GET \/ray\/cluster.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray\/cluster.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ray\/cluster.yaml",
            "request_line": "GET \/ray\/cluster.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray\/cluster.yaml",
        "evidence_snippet": "GET \/ray\/cluster.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "92b04dca0a4cefeb0a9ac25f9a730ae82bc908e4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 146,
    "payload_entropy": 5.1944169845957955,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "412f115f7f6e7fe22301697fb70be613e13423bc",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "d7ee0d76408818baf7bb45f1ee72f12b",
        "path_pattern_hash": "eb383a2a5384fdc12a036898666fd396"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
    "method": "GET",
    "path": "\/jupyter_server_config.json",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/jupyter_server_config.json HTTP\/1.1",
    "request_sample": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
    "evidence": {
        "method": "GET",
        "path": "\/jupyter_server_config.json",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/jupyter_server_config.json HTTP\/1.1",
        "request_sample": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b3bf14aeefadc6e7c54c73449322af13ad56e857",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/jupyter_server_config.json",
        "request_line": "GET \/jupyter_server_config.json HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter_server_config.json",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/jupyter_server_config.json",
            "request_line": "GET \/jupyter_server_config.json HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/jupyter_server_config.json",
        "evidence_snippet": "GET \/jupyter_server_config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "05f69b4c0c67fffaef76cd9fc8d547fd8e22e365",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 5.173284198979483,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "9b8c7029c075826c42166c098bff4dbe916ae75b",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "e8445f05acde0617130c2b3a18d73fd9",
        "path_pattern_hash": "61940843af8653395a163c6f3e0a0580"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/ray.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/ray.yml HTTP\/1.1",
    "request_sample": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ray.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/ray.yml HTTP\/1.1",
        "request_sample": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4cd5ab06ba604d175b837460157b125ec884ba73",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ray.yml",
        "request_line": "GET \/ray.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ray.yml",
            "request_line": "GET \/ray.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.yml",
        "evidence_snippet": "GET \/ray.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "0a771874dc35b4cb9c30eb8af7ae510ae29ce38d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.126727244076175,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "a93158ebded3224091f1d31846110a34db7871ac",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "05a750b98492bcd8375a89c7cf247274",
        "path_pattern_hash": "ccca247a8e1a432d6a6b2339159315ab"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/.ray\/ray.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/.ray\/ray.conf HTTP\/1.1",
    "request_sample": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/.ray\/ray.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/.ray\/ray.conf HTTP\/1.1",
        "request_sample": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ee8af296aa64a5d5b2dcdeea5f6e3df325e1aea1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.ray\/ray.conf",
        "request_line": "GET \/.ray\/ray.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.ray\/ray.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.ray\/ray.conf",
            "request_line": "GET \/.ray\/ray.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.ray\/ray.conf",
        "evidence_snippet": "GET \/.ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ef89d3b3dfb478ee960721790e15f1cfefb5b502",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.107833132607791,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "be72dc727122345b0b267b6fce006e89ae57bc1e",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "512f197ae00da024e3368e041c60e6e5",
        "path_pattern_hash": "0996922eac9cbc657e8ee13529358572"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/etc\/ray\/ray.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/ray\/ray.conf HTTP\/1.1",
    "request_sample": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/ray\/ray.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/ray\/ray.conf HTTP\/1.1",
        "request_sample": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f314831d9f559151cf56deb4ef055c3183fac563",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/ray\/ray.conf",
        "request_line": "GET \/etc\/ray\/ray.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/ray\/ray.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/ray\/ray.conf",
            "request_line": "GET \/etc\/ray\/ray.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/ray\/ray.conf",
        "evidence_snippet": "GET \/etc\/ray\/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "570bffd1e3b8affdb86f4cd5a45ccd0ae5459f04",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 128,
    "payload_entropy": 5.1281152850993195,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "2c5a81e42f32d467c30c1a0c4d5fc731ed097b2e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "c55b36d9f9ca2ce82ef293e115c5ba55",
        "path_pattern_hash": "5d9df0fdda8e7123ea160979a684ec6e"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/ray.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/ray.conf HTTP\/1.1",
    "request_sample": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ray.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/ray.conf HTTP\/1.1",
        "request_sample": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "58adc69157e3cfdf15344f5740a0110467f46bb6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ray.conf",
        "request_line": "GET \/ray.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ray.conf",
            "request_line": "GET \/ray.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.conf",
        "evidence_snippet": "GET \/ray.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c27d7523ef1ae6ee05ab22a68dbab377e3d67fd5",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 128,
    "payload_entropy": 5.168312527503434,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "fcac19947d331d1e70571e351c2f49e4f443f54f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "14345994cbbd51ebe959bcc87c0334d7",
        "path_pattern_hash": "60480f18c7ad1f18120d474582dc7e58"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/ray.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/ray.yaml HTTP\/1.1",
    "request_sample": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ray.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/ray.yaml HTTP\/1.1",
        "request_sample": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "81e5d7b89c7a6831a26392b1e9cec9c86f7073a9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ray.yaml",
        "request_line": "GET \/ray.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ray.yaml",
            "request_line": "GET \/ray.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ray.yaml",
        "evidence_snippet": "GET \/ray.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f2169b0b4dc5e7adda8d01a4d91713b21d5871d9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 136,
    "payload_entropy": 5.1730795250043755,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "0eda7ebf6179a6c91061083d0d7e52998bfb285d",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "519c4fb615d5a5dee3ec2cfa658d3536",
        "path_pattern_hash": "16f55dbca61b126a741b0bf6ead85a69"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "method": "GET",
    "path": "\/slurm\/slurm.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/slurm\/slurm.conf HTTP\/1.1",
    "request_sample": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "evidence": {
        "method": "GET",
        "path": "\/slurm\/slurm.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/slurm\/slurm.conf HTTP\/1.1",
        "request_sample": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7605175ddcdafc156315ba4c7f60c6f971012904",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/slurm\/slurm.conf",
        "request_line": "GET \/slurm\/slurm.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurm\/slurm.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/slurm\/slurm.conf",
            "request_line": "GET \/slurm\/slurm.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurm\/slurm.conf",
        "evidence_snippet": "GET \/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "template",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "8585806a9f1035e8a0448e6a49bc75de78ff725c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 149,
    "payload_entropy": 5.116693752725963,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "ba02f614ceb6604082075a4f1913a687caf24e51",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "e427e0db940566fba3f98f376054f669",
        "path_pattern_hash": "e1e60209fad45ffb2c21e2b659f536cf"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
    "method": "GET",
    "path": "\/etc\/slurm\/slurm.conf.template",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1",
    "request_sample": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/slurm\/slurm.conf.template",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1",
        "request_sample": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a32eb21efeb7257a345084f3b4ff8fc36e96229",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/slurm\/slurm.conf.template",
        "request_line": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurm.conf.template",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/slurm\/slurm.conf.template",
            "request_line": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurm.conf.template",
        "evidence_snippet": "GET \/etc\/slurm\/slurm.conf.template HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "563fda13a23f09b66709a24b7129124d25d3df2f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 143,
    "payload_entropy": 5.159979533438884,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "5acb172a523d9cc5cbe01b85fcec4ddd27063202",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "3c4803bc5f855eaabfb49f2cb56808df",
        "path_pattern_hash": "39160d937ba81b840fd840e2616783c1"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "method": "GET",
    "path": "\/etc\/slurm\/slurmdbd.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1",
    "request_sample": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/slurm\/slurmdbd.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1",
        "request_sample": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8d13a7968acf6541c3e37e0aa410adab85f0770c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/slurm\/slurmdbd.conf",
        "request_line": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurmdbd.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/slurm\/slurmdbd.conf",
            "request_line": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurmdbd.conf",
        "evidence_snippet": "GET \/etc\/slurm\/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "38f89c27cf0913c5695b174498032370f5b06831",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 140,
    "payload_entropy": 5.149071299977924,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 32,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
    "event_fingerprint": "9e9f89380d2f9a6d0935dac17153475ed7c324c8",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "9c67f690edc78535f309bf8630ff44a6",
        "path_pattern_hash": "6a3bf7baea9c8b6b5488556ee1d52a88"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "method": "GET",
    "path": "\/etc\/slurm\/slurm.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "waf_tags": [
        "950468:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1",
    "request_sample": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "evidence": {
        "method": "GET",
        "path": "\/etc\/slurm\/slurm.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "waf_tags": [
            "950468:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1",
        "request_sample": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a5749a07682a3e8a662c7f5a29ff157425b4d44b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/etc\/slurm\/slurm.conf",
        "request_line": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurm.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/etc\/slurm\/slurm.conf",
            "request_line": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/slurm\/slurm.conf",
        "evidence_snippet": "GET \/etc\/slurm\/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "b84faab368ca17dd913c3166f4ac7a369b9f37b4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 133,
    "payload_entropy": 5.164294630710383,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "e0d80ee13c3550aaeab5df0729954e96fb14ce0f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "ea83bf2de5e9774f0dc4ca8d9dce9336",
        "path_pattern_hash": "6d3bee96207e48e80a290adba9763087"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "method": "GET",
    "path": "\/slurmdbd.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/slurmdbd.conf HTTP\/1.1",
    "request_sample": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "evidence": {
        "method": "GET",
        "path": "\/slurmdbd.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/slurmdbd.conf HTTP\/1.1",
        "request_sample": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bd57436280ac215239766729fab7071c53b65a80",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/slurmdbd.conf",
        "request_line": "GET \/slurmdbd.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurmdbd.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/slurmdbd.conf",
            "request_line": "GET \/slurmdbd.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurmdbd.conf",
        "evidence_snippet": "GET \/slurmdbd.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "conf",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "c81ac0740a03671186d33201932390c77b59e527",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.155087116605271,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "b2140a7f2b4fee65c5f857d3e40125c5f7e78df5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "278946c6dce163a6d5b81106e61965e8",
        "path_pattern_hash": "f1750e59ea14210eb9d94d980eb70186"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
    "method": "GET",
    "path": "\/slurm.conf",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/slurm.conf HTTP\/1.1",
    "request_sample": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/slurm.conf",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/slurm.conf HTTP\/1.1",
        "request_sample": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20c62f010df79cd7e303c96663dadd821c89e015",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/slurm.conf",
        "request_line": "GET \/slurm.conf HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurm.conf",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/slurm.conf",
            "request_line": "GET \/slurm.conf HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/slurm.conf",
        "evidence_snippet": "GET \/slurm.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "9ea8de29d68040c6310525771d9b768225288adb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 129,
    "payload_entropy": 5.103146520246483,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 37,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "2ad75f2a26924157960a43991fb1a44fc5d9cf4e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.52,
    "classification_confidence": 0.52,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 37
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "0285ccec6ef5149086cca4b6f0931bb9",
        "path_pattern_hash": "5b97c159a9a28c2745fa2f6c93a65d09"
    },
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 37
    },
    "payload_preview": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
    "method": "GET",
    "path": "\/user-data",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/user-data HTTP\/1.1",
    "request_sample": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/user-data",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/user-data HTTP\/1.1",
        "request_sample": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f3d2731ec2d2293c56fadee8fe2f8a2a8d2d3918",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/user-data",
        "request_line": "GET \/user-data HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/user-data",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
        "confidence_pct": 52,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 37
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 37,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/user-data",
            "request_line": "GET \/user-data HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/user-data",
        "evidence_snippet": "GET \/user-data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "b377e678a79d455dcacacfde7a799ce6126cdfa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 129,
    "payload_entropy": 5.128302431082425,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "0556a7f109232a15a351389b87ce0311cc2e2743",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "0a1f1b3600faecdb36a1cd688f6cdaca",
        "path_pattern_hash": "8397cfe809797f13ab08eaefc21d6322"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
    "method": "GET",
    "path": "\/user_data",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/user_data HTTP\/1.1",
    "request_sample": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/user_data",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/user_data HTTP\/1.1",
        "request_sample": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ec794ae70152ed8bba9861dbeb2d9588301efde5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/user_data",
        "request_line": "GET \/user_data HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/user_data",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/user_data",
            "request_line": "GET \/user_data HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/user_data",
        "evidence_snippet": "GET \/user_data HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "d823892ab093944ff0680c44ee77216026a561c2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 127,
    "payload_entropy": 5.117533683534947,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "de072793fa60de637e6d12d516aeecb35feaa51e",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "0c1ef7126b6e4a33d54516d271e8728d",
        "path_pattern_hash": "9409126c72e9b78ac56bf07ede1ffe3c"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "method": "GET",
    "path": "\/gpu.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/gpu.pem HTTP\/1.1",
    "request_sample": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/gpu.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/gpu.pem HTTP\/1.1",
        "request_sample": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b2e8bb6da0d485e73a624a4a808bfc86f827b470",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/gpu.pem",
        "request_line": "GET \/gpu.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/gpu.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/gpu.pem",
            "request_line": "GET \/gpu.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/gpu.pem",
        "evidence_snippet": "GET \/gpu.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "ae6b7fdcb8f024f44d1d1d41772cbeda433c96eb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 134,
    "payload_entropy": 5.163193179598071,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "779eac9d94767672d9663827c24541339b7f4b4a",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "4a010b39524b95a1bcf406e645d56026",
        "path_pattern_hash": "755c0ecbec070daeb945201efdc0a660"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "method": "GET",
    "path": "\/cloud-init.yml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/cloud-init.yml HTTP\/1.1",
    "request_sample": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "evidence": {
        "method": "GET",
        "path": "\/cloud-init.yml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/cloud-init.yml HTTP\/1.1",
        "request_sample": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6d02f42794c0e310f1eeba74373a2e20f294aa4c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cloud-init.yml",
        "request_line": "GET \/cloud-init.yml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloud-init.yml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cloud-init.yml",
            "request_line": "GET \/cloud-init.yml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloud-init.yml",
        "evidence_snippet": "GET \/cloud-init.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "897de1264af56a7df2ed685209226b9889336930",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.1825020529323895,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "0df7f569b41ff27b6b998be68f8f5d336fb00438",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "d70ca0afd586f5f3c1078a3fdbdd7974",
        "path_pattern_hash": "60187320c386c89ce0b09e6ab0baee92"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/gpu_key.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/gpu_key.pem HTTP\/1.1",
    "request_sample": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/gpu_key.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/gpu_key.pem HTTP\/1.1",
        "request_sample": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5a6d8f609f2798078cf8f5e4e757f1fcb6c823d3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/gpu_key.pem",
        "request_line": "GET \/gpu_key.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/gpu_key.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/gpu_key.pem",
            "request_line": "GET \/gpu_key.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/gpu_key.pem",
        "evidence_snippet": "GET \/gpu_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "584d0727f46489302edf1cb4cf0da5f53bf1fc23",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 131,
    "payload_entropy": 5.185481896638978,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "a06b3618a0248f453100cd8cff94822e8452fb23",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "f7d9ebfee004d456146a3c5550365edd",
        "path_pattern_hash": "4e6f1d7ae65b6b0a19c11d1e98b22aad"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
    "method": "GET",
    "path": "\/ssh_key.pem",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/ssh_key.pem HTTP\/1.1",
    "request_sample": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "evidence": {
        "method": "GET",
        "path": "\/ssh_key.pem",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/ssh_key.pem HTTP\/1.1",
        "request_sample": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e371d5bf8ec91f3bd3a671fede1d2415625c1ba",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/ssh_key.pem",
        "request_line": "GET \/ssh_key.pem HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ssh_key.pem",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/ssh_key.pem",
            "request_line": "GET \/ssh_key.pem HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ssh_key.pem",
        "evidence_snippet": "GET \/ssh_key.pem HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
    "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
    "http_target_hash": "f09bd23fda7e30581aa459a3307aad89c211a167",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 135,
    "payload_entropy": 5.161277034609079,
    "port_category": "registered",
    "org": "Oracle Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 31898,
    "country": "SG",
    "dst_port": 9400,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 5,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
    "event_fingerprint": "3a535e53c7469cdcd12a23a8619a8310e3b8b4d9",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 31898,
        "org": "Oracle Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
        "payload_hash": "6cc2bbb565fa0c0473305b1243b86b0c",
        "path_pattern_hash": "be4f065551ea36de0d17f4739090eb63"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9400,
        "service": "http",
        "service_name": "http",
        "risk_score": 5
    },
    "payload_preview": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "method": "GET",
    "path": "\/cloud-init.yaml",
    "user_agent": "WebSiphon\/next-0.1",
    "request_line": "GET \/cloud-init.yaml HTTP\/1.1",
    "request_sample": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
    "payload_snippet": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "evidence": {
        "method": "GET",
        "path": "\/cloud-init.yaml",
        "user_agent": "WebSiphon\/next-0.1",
        "request_line": "GET \/cloud-init.yaml HTTP\/1.1",
        "request_sample": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
        "payload_snippet": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 5
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5c490e5b69938d8ef401527d2af2063a3636eba9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cloud-init.yaml",
        "request_line": "GET \/cloud-init.yaml HTTP\/1.1",
        "http_user_agent": "WebSiphon\/next-0.1",
        "port": 9400,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
    "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloud-init.yaml",
    "target_port_label": "9400 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 5
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 5,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9400,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cloud-init.yaml",
            "request_line": "GET \/cloud-init.yaml HTTP\/1.1",
            "http_user_agent": "WebSiphon\/next-0.1",
            "port": 9400,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloud-init.yaml",
        "evidence_snippet": "GET \/cloud-init.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
        "target_port_label": "9400 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9400"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}