{"ip":"163.192.108.53","exported_at":"2026-10-29T10:22:49+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":57,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1499","top_mitre_count":254,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15,"risk_score":51},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499"],"tags_summary":["MITRE-T1499"],"attack_vector":"http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.mcp.json","protocol_details":{"http_method":"GET","http_path":"\/.mcp.json","request_line":"GET \/.mcp.json HTTP\/1.1","http_user_agent":"WebSiphon\/next-0.1","port":8888,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/.mcp.json \u00b7 UA WebSiphon\/next-0.1 \u00b7 HTTP:8888","evidence_snippet":"GET \/.mcp.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:8888","target_port_label":"8888 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 1 signal(aux) capteur","classification_reason":"Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab Flood \/ DDoS \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8","payload_preview":"GET \/.mcp.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:8888","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"53.108.192.163.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":5034646,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55836,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/.mcp.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022746300123466d06c8425aa1f55066af88a790263\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.1217469999398135, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022829cb47a4bdaa8c0ebc4465313423468485793c3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022e16cccb3949c45754da9747de15036e8\u0022, \u0022path_pattern_hash\u0022: \u002216a65f521dd21a3347dfe1cb951d3f4f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/.mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d75ea89f292cb772f757d4a1055364fdfc95a2bf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/.mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.mcp.json\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/.mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.mcp.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":129},{"id":5034645,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55876,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.continue\/config.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002247e6b7695248776398dd747cea1e589cd03f87b1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 141, \u0022payload_entropy\u0022: 5.073271080934256, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 14, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 55, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002243669c5ad54170a0948e6be12ad79cae3d94f8ac\u0022, \u0022event_fingerprint\u0022: \u0022c18f9387b7b1bf0599a2fb24bb47ae356bbb42bb\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0697\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022Conti\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0697\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00228e2dc0faa2d6bacd24625844fc482df5\u0022, \u0022path_pattern_hash\u0022: \u0022103ab5875c63017070e52606553bef33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 55}, \u0022payload_preview\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.continue\/config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.continue\/config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229f3c6544b8f6310a7aafd4342a8a18299ea414d3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.continue\/config.json\u0022, \u0022request_line\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.continue\/config.json\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 55, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.continue\/config.json\u0022, \u0022request_line\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.continue\/config.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.continue\/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_ransomware_note_pattern\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_ransomware_note_pattern\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":141},{"id":5034644,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55890,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/jupyter_server_config.py","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022py\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002233f298dada22d0bf7c1da8ef390179d5e1e784ab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 144, \u0022payload_entropy\u0022: 5.182194598990674, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022a35893a42bddc2f8a5cc0819a0706c2af9200b56\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022175547780d5deb8b76dea17571b7482e\u0022, \u0022path_pattern_hash\u0022: \u00223ddac9c80974f3121d949503a3c577ae\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/jupyter_server_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/jupyter_server_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f1bac3a4c9a82a328948caa0ec8ae6382374fe01\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/jupyter_server_config.py\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/jupyter_server_config.py\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/jupyter_server_config.py\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/jupyter_server_config.py\u0022, \u0022evidence_snippet\u0022: \u0022GET \/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":144},{"id":5034643,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55868,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.continue\/config.yaml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022yaml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002264354765d7299b35cd089a508e1196f87b495cb7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 141, \u0022payload_entropy\u0022: 5.112808006966863, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 14, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 55, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227361948455eb403697a8c80627dbdb0c55316ca4\u0022, \u0022event_fingerprint\u0022: \u002286db6189046850a61c979bc47d9f47323d8e2a84\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0697\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022Conti\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0697\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022dabd9124b6749ccd705584f8ac04ce30\u0022, \u0022path_pattern_hash\u0022: \u00227a127dd45b315db97dc391f5daff19ec\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 55}, \u0022payload_preview\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.continue\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.continue\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ae698e60fe1e287cd66dd9db59b8c6746f1e83a7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.continue\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.continue\/config.yaml\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 55, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.continue\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.continue\/config.yaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.continue\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_ransomware_note_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_ransomware_note_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":141},{"id":5034642,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55954,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/.env.production","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022production\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002221b8696a6510a433c6f0b40c4b619a659cbe7513\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 141, \u0022payload_entropy\u0022: 5.103135724207164, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e75efb96d27b98ae51a6ae8c7a142ec78452a3de\u0022, \u0022event_fingerprint\u0022: \u002206274cbf09731921d1fde852386991938f43afac\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022e32ee49df1c6464d1b6d000cf226613a\u0022, \u0022path_pattern_hash\u0022: \u0022c44ab0ae33fb86a13551b4329d95e28b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env.production\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env.production\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224772b8f22c49a3f3ebbe8a8ab184c3167a814117\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env.production\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env.production\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":141},{"id":5034641,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55850,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.cursor\/mcp.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00226cfca9b44e62934617e1937e5f40b5ed25e9be1d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 136, \u0022payload_entropy\u0022: 5.129013901146294, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022be85e19ff214c77d130f07083587054fda5defd9\u0022, \u0022event_fingerprint\u0022: \u0022a83dde2a76cdd04f34c2796ec90ef13948195f6a\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022b88e83984793c85cc3c78c5df732c715\u0022, \u0022path_pattern_hash\u0022: \u0022e5f0c47e5c108bbe5311841115288938\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.cursor\/mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.cursor\/mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002248c9db389417d008fbe1c3c58a425d1bf680b41e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.cursor\/mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.cursor\/mcp.json\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.cursor\/mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.cursor\/mcp.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.cursor\/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":136},{"id":5034640,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55854,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/mcp.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022fa7e04887e7fd100616a24907beff039f071b515\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.1281152850993195, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022f4d88873d2f2a4b387ceab7b1ed3b66bd254ac60\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00228e9b97f053a6169898e4eb925f4e170d\u0022, \u0022path_pattern_hash\u0022: \u00224f0d5369a15d4ff113bc7ab335025781\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mcp.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/mcp.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002279d7889ec84c88291f4706d7464bf15e31de56e8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mcp.json\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mcp.json\u0022, \u0022request_line\u0022: \u0022GET \/mcp.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mcp.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/mcp.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":128},{"id":5034639,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55832,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/config\/truss.yaml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022yaml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022997408248863996469475a29303e243e2e65fe06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 137, \u0022payload_entropy\u0022: 5.157573554292835, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa1d30db0e0f4c4630d1347124de02963419ead3\u0022, \u0022event_fingerprint\u0022: \u0022c19ca222a258751639e597263b77739557b49bc9\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022b10ca02c253d8c7f513113c60506533e\u0022, \u0022path_pattern_hash\u0022: \u00229389660812b8429a19badf85db0f9513\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/truss.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/truss.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222792595bbfdff354488238678e961816406a9479\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/truss.yaml\u0022, \u0022request_line\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/truss.yaml\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/truss.yaml\u0022, \u0022request_line\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/truss.yaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/truss.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_probe_config\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_probe_config\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":137},{"id":5034638,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55960,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/workspace\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00227f39b7c8b8ec814f458b6a8499beb206d9b23c9c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 140, \u0022payload_entropy\u0022: 5.140311613519536, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e75efb96d27b98ae51a6ae8c7a142ec78452a3de\u0022, \u0022event_fingerprint\u0022: \u0022d6bfd13686388218d39b5e7745795cd72a0734bf\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022898484a4cdad051dafb9fd377ef56172\u0022, \u0022path_pattern_hash\u0022: \u0022bdff4bf1f3ba70cd4c814afc93b522c3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d2f2f26fd021b15a743ba7a384f739b9047218f9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/workspace\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/workspace\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":140},{"id":5034637,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55972,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/workspace\/app\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022d5837856cc89b623bf7577c5e6f36dd1fb148cd1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 144, \u0022payload_entropy\u0022: 5.124510526168057, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e75efb96d27b98ae51a6ae8c7a142ec78452a3de\u0022, \u0022event_fingerprint\u0022: \u00221f3df0dc58ec5a742ceb6ad83b795a84b0bc162b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022e945527b7f55c22ff7037acfa31e22a8\u0022, \u0022path_pattern_hash\u0022: \u00224f221b5b6da227895365c19cbe1159c1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/app\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/app\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002200a71914fc623c4aa94f05f7531a9574a1103023\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/app\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/workspace\/app\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/app\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/workspace\/app\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/app\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":144},{"id":5034636,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55928,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.ipython\/profile_default\/startup\/00-env.py","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: \u0022py\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00226e9c8d6d41d89c2f5f349323fbc45b7ce2055b28\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 162, \u0022payload_entropy\u0022: 5.147135056851123, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022be85e19ff214c77d130f07083587054fda5defd9\u0022, \u0022event_fingerprint\u0022: \u00223892170db02f154a1aca348178d7491f697f10ce\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00220868f1bb169b6bc5f7736a2bdbacba26\u0022, \u0022path_pattern_hash\u0022: \u0022fff44410c23319a6ec05e65bec8bf1ef\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,def\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,def\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,def\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cfc7fbca2ed3cb33b22a5d2eba6b934f45f2dd58\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022request_line\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,def\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022request_line\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.ipython\/profile_default\/startup\/00-env.py\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.ipython\/profile_default\/startup\/00-env.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,def\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":162},{"id":5034635,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55934,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00225c3c9c4ac6cc2bb080d395e76c7aedeb0c656c28\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.105248337879019, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e75efb96d27b98ae51a6ae8c7a142ec78452a3de\u0022, \u0022event_fingerprint\u0022: \u0022e3c5ca849e53aa67f1d0e43cc6f6f895f74a5697\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00224fded0c84bbeb528eab7388eb996bfe1\u0022, \u0022path_pattern_hash\u0022: \u00224d646c08731de49e2b83aa25e9d5dd81\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022062079b64e5edd458af4eae7d6b5caad2cd44779\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":5034634,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55916,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.jupyter\/jupyter_server_config.py","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022py\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00228b040b9fddf88b89caae26649963184c58d6f09b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.172611184296438, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022be85e19ff214c77d130f07083587054fda5defd9\u0022, \u0022event_fingerprint\u0022: \u00228c560b1f23b00c6ebf20cd7b0833a4a269ad0dcd\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00220445ce2719528f97cc40a32e41b054cd\u0022, \u0022path_pattern_hash\u0022: \u0022a13f53f874f5699149a23bf40191c5d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.jupyter\/jupyter_server_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.jupyter\/jupyter_server_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226c490c92916d0160579c9a558d4e05e2b33815ef\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.jupyter\/jupyter_server_config.py\u0022, \u0022request_line\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.py\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.jupyter\/jupyter_server_config.py\u0022, \u0022request_line\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.jupyter\/jupyter_server_config.py\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.jupyter\/jupyter_server_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":5034633,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55900,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/jupyter_notebook_config.py","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022py\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022c7bf27598485b2f93dae5b3044a25b5f246356d5\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 146, \u0022payload_entropy\u0022: 5.172329132666347, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022d9ca5d231b9f4ce517dc021248bae9ec254073d1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00227370524879c63417729f424eaa131713\u0022, \u0022path_pattern_hash\u0022: \u002228f680518ba951970bb594ed5cfe406c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/jupyter_notebook_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/jupyter_notebook_config.py\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fcca0c9a28a53ce500e495440f658a79585201d5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/jupyter_notebook_config.py\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/jupyter_notebook_config.py\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/jupyter_notebook_config.py\u0022, \u0022request_line\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/jupyter_notebook_config.py\u0022, \u0022evidence_snippet\u0022: \u0022GET \/jupyter_notebook_config.py HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":146},{"id":5034632,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55946,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/.env.local","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002206dfd01218afd18e21314f137a047a021ccb3ebd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 136, \u0022payload_entropy\u0022: 5.1012707182969095, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e75efb96d27b98ae51a6ae8c7a142ec78452a3de\u0022, \u0022event_fingerprint\u0022: \u00228eeec995dd22a0c434a5bd4e73e9c75c95bea28f\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002284928c18da06aedac7840f3872f65d77\u0022, \u0022path_pattern_hash\u0022: \u0022007792997b7935bc9b5aca31ac5006ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env.local\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env.local\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ee915156792081b4b27fe57d11e3ca8b40ad3867\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env.local\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env.local\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":136},{"id":5034631,"ip":"163.192.108.53","ts":"2026-10-20 01:07:30.000000","proto":"tcp","src_port":55862,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/mcp_config.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022b8070bc493c9612f5a42491479fb12b4cea38203\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.151004279439354, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022838cc5f2c5549ca8a395fdd6856dbd314cd81dc8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022a68ba5165a8855410a14d17842e6a753\u0022, \u0022path_pattern_hash\u0022: \u002262c63201acc2a620cf319fd424b802a4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mcp_config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mcp_config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222021da54ec6e286d3940c6eee9a1aad32ebe187a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mcp_config.json\u0022, \u0022request_line\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mcp_config.json\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mcp_config.json\u0022, \u0022request_line\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mcp_config.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/mcp_config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":135},{"id":5034122,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55786,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/webui-user.sh","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sh\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022c0fcad4541cdc71b2f3d99d22ffb2e056395e031\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.121255880843848, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0e49f1430e3bf990863ea533bbf40c5615c9173\u0022, \u0022event_fingerprint\u0022: \u0022bd01cdf1f020fb2a6cbfe80c7c86ed56ae1bb2b8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022a7ff5bade9d6bea80e2a2e9d211dd8f7\u0022, \u0022path_pattern_hash\u0022: \u0022aacdd7281c2f713e53abdc367b7cd8bf\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:888\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/webui-user.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/webui-user.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:888\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226910776e21d5bf35b94ad6e03f0d0b5a148404d2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/webui-user.sh\u0022, \u0022request_line\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:888\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/webui-user.sh\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/webui-user.sh\u0022, \u0022request_line\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/webui-user.sh\u0022, \u0022evidence_snippet\u0022: \u0022GET \/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":133},{"id":5034121,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55814,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/llm\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022cc759da9674a563f96dcdaac860485142526a28f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.131672246754271, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d2875b8e77456fb590d1aec8248e965473ca7935\u0022, \u0022event_fingerprint\u0022: \u0022738850f13f65b47a39f05990af8551c0b35b29e3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022aaece7271e31edddeec496490c214d79\u0022, \u0022path_pattern_hash\u0022: \u00225f1e200fee76f29230b72ae39a7b0a4f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/llm\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/llm\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/llm\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/llm\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222724f68f0003823c657db691e679114d77bab024\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/llm\/.env\u0022, \u0022request_line\u0022: \u0022GET \/llm\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/llm\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/llm\/.env\u0022, \u0022request_line\u0022: \u0022GET \/llm\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/llm\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/llm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":128},{"id":5034120,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55794,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/text-generation-webui\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022a6087ca08a067c931faa1c1d02639a24aa4df575\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 146, \u0022payload_entropy\u0022: 5.0713062417804755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d2875b8e77456fb590d1aec8248e965473ca7935\u0022, \u0022event_fingerprint\u0022: \u00224e1a822654a91e0602d552e3db6992937fdc2b5c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002221a297dfa8a43a1563347e6fe0b5261f\u0022, \u0022path_pattern_hash\u0022: \u0022c627c096f348362332afc781d00b1af9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/text-generation-webui\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/text-generation-webui\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227d040f51e0b5517a8771f7ed2497ad4c276af5b2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/text-generation-webui\/.env\u0022, \u0022request_line\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/text-generation-webui\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/text-generation-webui\/.env\u0022, \u0022request_line\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/text-generation-webui\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/text-generation-webui\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 6\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":146},{"id":5034119,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55798,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/vllm\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00221e64994c32256b1d20186182e46a5c10dbdd42fa\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.141878787086404, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d2875b8e77456fb590d1aec8248e965473ca7935\u0022, \u0022event_fingerprint\u0022: \u0022aa18564fb9395bceb41df52c1c1bf00882ceb101\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022fd99b231646d0645b0e45cf582b56d1c\u0022, \u0022path_pattern_hash\u0022: \u002268ba374e443da6d953e134dbc34291ed\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/vllm\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/vllm\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002266339e5a8c30160e38e08239c5813213ceb0ac4c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/vllm\/.env\u0022, \u0022request_line\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/vllm\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/vllm\/.env\u0022, \u0022request_line\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/vllm\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/vllm\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":129},{"id":5034118,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55806,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/truss\/config.yaml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022yaml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00226b41ecb34c06dbffba54f7d91aa6506bca65176f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 137, \u0022payload_entropy\u0022: 5.157573554292835, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226481c6894b403a83f6bf1d4060caa5f547bbf965\u0022, \u0022event_fingerprint\u0022: \u002229da5ba40e985c806dd7d6e01c2208544ab1c050\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002233e9004e1766e03c0bfce67c318aa9bf\u0022, \u0022path_pattern_hash\u0022: \u0022da7536945b852666c4f360df0318ed65\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/truss\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/truss\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221a5ea126a1a7fd0faf80793e3bc088456945623d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/truss\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/truss\/config.yaml\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/truss\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/truss\/config.yaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/truss\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":137},{"id":5034117,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55784,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/workspace\/stable-diffusion-webui\/webui-user.sh","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022sh\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u00225993a59a288598643d0ebf3324b23a5fe0600398\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 166, \u0022payload_entropy\u0022: 5.1344809994165, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022be85e19ff214c77d130f07083587054fda5defd9\u0022, \u0022event_fingerprint\u0022: \u002289f8b23712067b61e0aa530dd85fe740a8462f84\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022563cbbe4de3250c6ffeb88dfa5f8bf3b\u0022, \u0022path_pattern_hash\u0022: \u0022f9f8f8d2b153913622390db6e294f502\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222002177581984859742773efd518851ebc87356f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022request_line\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022request_line\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/workspace\/stable-diffusion-webui\/webui-user.sh\u0022, \u0022evidence_snippet\u0022: \u0022GET \/workspace\/stable-diffusion-webui\/webui-user.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":166},{"id":5034116,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55824,"dst_port":8888,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/inference\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022e1cf37ad9d6aa6ef16555bf02284f1c1ea1fc411\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 134, \u0022payload_entropy\u0022: 5.05364247533976, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d2875b8e77456fb590d1aec8248e965473ca7935\u0022, \u0022event_fingerprint\u0022: \u00220e9c375c303558b4745f3ab1d66bf9b6b490bc7b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002221b1de754a262c3cf3d3a778cb29902b\u0022, \u0022path_pattern_hash\u0022: \u00226bbbe7a0071a5847d6d8f607e9a1c652\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:88\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/inference\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/inference\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:88\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/inference\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/inference\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:88\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e191801540b8cc2a2444a07ee13ddfc48012ef5d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/inference\/.env\u0022, \u0022request_line\u0022: \u0022GET \/inference\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:88\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/inference\/.env\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/inference\/.env\u0022, \u0022request_line\u0022: \u0022GET \/inference\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/inference\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/inference\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:88\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":134},{"id":5034115,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55796,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/text-generation-webui\/settings.yaml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022yaml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022731b774341eb1675fc00aa8f0f32d01c499a1c8d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 5.093943717385338, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226481c6894b403a83f6bf1d4060caa5f547bbf965\u0022, \u0022event_fingerprint\u0022: \u0022cab544af37157f7ba0c051538dac8ce4ab171aab\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022e2e195d5577f868ee59f75904699234d\u0022, \u0022path_pattern_hash\u0022: \u0022d12c061953d917665f843fa982c45ccb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/text-generation-webui\/settings.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/text-generation-webui\/settings.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228b6b6efe114de9e7a97f86d1d94c44bdf7d5e3c2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/text-generation-webui\/settings.yaml\u0022, \u0022request_line\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/text-generation-webui\/settings.yaml\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/text-generation-webui\/settings.yaml\u0022, \u0022request_line\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/text-generation-webui\/settings.yaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/text-generation-webui\/settings.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":155},{"id":5034114,"ip":"163.192.108.53","ts":"2026-10-20 01:07:25.000000","proto":"tcp","src_port":55816,"dst_port":8888,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/inference\/config.yaml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022yaml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u0022f41b21c6261597b30ee8c33a33832aea46790798\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 141, \u0022payload_entropy\u0022: 5.102758470161772, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226481c6894b403a83f6bf1d4060caa5f547bbf965\u0022, \u0022event_fingerprint\u0022: \u0022544eac04e60ed4bfa415ab37d57e2593b97c95c0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022432dcb32c6ca6472694237c3d7997983\u0022, \u0022path_pattern_hash\u0022: \u0022ad3e235090fadf8883455da2a69cfa53\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/inference\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/inference\/config.yaml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8888\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dae2e75e6445e1862716a36059662ff6753ea540\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/inference\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/inference\/config.yaml\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/inference\/config.yaml\u0022, \u0022request_line\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/inference\/config.yaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/inference\/config.yaml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.5\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":141}],"total_events":410}