{"ip":"163.192.217.96","exported_at":"2026-10-23T08:37:47+00:00","period_days":30,"metrics":{"events7d":59,"distinct_ports":1,"distinct_classifications":9,"max_severity":9,"last_sensor_id":"paris-1","max_waf_score":18,"max_risk_score":57,"attack_stage":"recon","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.52,"risk_breakdown":{"waf":48,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"mitre_tactics":["TA0043"],"mitre_technique":"TA0043","top_mitre_technique":"TA0007","top_mitre_count":27,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":48,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":37},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":52,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["Beh Scan Burst"],"tags_summary":["INT-beh-scan-burst"],"attack_vector":"port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/contents\/workspace","protocol_details":{"http_method":"GET","http_path":"\/api\/contents\/workspace","request_line":"GET \/api\/contents\/workspace HTTP\/1.1","http_user_agent":"WebSiphon\/next-0.1","port":8080,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/api\/contents\/workspace \u00b7 UA WebSiphon\/next-0.1 \u00b7 HTTP:8080","evidence_snippet":"GET \/api\/contents\/workspace HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.","target_port_label":"8080 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 52 % \u2014 2 tag(s) WAF","classification_reason":"Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%","classification_reason_label_fr":"Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%","confidence_factors_fr":"Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF","payload_preview":"GET \/api\/contents\/workspace HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"96.217.192.163.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":4686822,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50116,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/contents\/workspace","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u002207ed472f33e43275abdf1d1ccf0e545c31d3bf1b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 142, \u0022payload_entropy\u0022: 5.080918857701374, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u0022373940401e1b46c39880b6216ef99e3ef90aba33\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022365447fab9f4050296e25258212807a8\u0022, \u0022path_pattern_hash\u0022: \u0022de1407644bf945f7ae309d1c08342f87\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/workspace\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/workspace\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f7227a5672adf82445a3c4882dc43b5d8a97a810\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/workspace\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/contents\/workspace\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/workspace\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/contents\/workspace\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/workspace HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":142},{"id":4686821,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50232,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022550c2ec4c29c432f9a6bf5d6f73f786994cf6c15\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.09968367476867, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u002237492f33bbccd567e79514a5cd83790c5bd115ee\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00220873cdb3305bc90e5676f31930cde8ef\u0022, \u0022path_pattern_hash\u0022: \u00225694bd8f8cc07635f19710e0b27b1995\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/version\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/version\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221cbf891c55b87716e02e39577c925c1b7e7189ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/version\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":131},{"id":4686820,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50354,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/config.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022110dc2bb220538a9df6ea13fd8474a5056c773dc\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.10797889502572, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002242191e08607efd519d8f66f9dbc41c83306b2303\u0022, \u0022event_fingerprint\u0022: \u0022606fbb0ea76f03219065fcbb34cd9a9d36f3b235\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 152, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022pat-0247\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022pat-0247\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0247\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/config.json\u0022], \u0022pattern_ids\u0022: [\u0022pat-0247\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022b1c816d75fbb9379453b6f9d5f9c70e6\u0022, \u0022path_pattern_hash\u0022: \u0022b2ebf86a95e6e198c8d34ea73388c4ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/config.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e164510d94488fb67546787a9f61aab1efaab3f8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.json\u0022, \u0022request_line\u0022: \u0022GET \/config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config.json\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022pat-0247\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022pat-0247\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.json\u0022, \u0022request_line\u0022: \u0022GET \/config.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":131},{"id":4686819,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50406,"dst_port":8080,"service":"http","classification":"prometheus_probe","waf_score":6,"waf_tags":"[\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022]","http_method":"GET","http_target":"\/metrics","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020\u0022, \u0022emulator_response_len\u0022: 154, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00227edfc244708a7b5c7d4b4385c178aa8e03afde7f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.100669829597339, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223a7d17bd9b6e499b8f3b03e2ff1e44389fcf2bbf\u0022, \u0022event_fingerprint\u0022: \u00220860b0de96b966078ff4035d05b1d99332511c2f\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-benign-metrics\u0022, \u0022INT-upstream\u0022, \u0022INT-sqli-tag-only-metrics\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-benign-metrics\u0022, \u0022INT-upstream\u0022, \u0022INT-sqli-tag-only-metrics\u0022], \u0022matched_patterns\u0022: [\u0022pat-0266\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/metrics\u0022], \u0022pattern_ids\u0022: [\u0022pat-0266\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022ceb7f89edcd366f2dd9c7fcc8d16d364\u0022, \u0022path_pattern_hash\u0022: \u0022b4bbca6caf5247626ee41b68231d40e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002213d871752e6757bac1f0dadba26222bb73267ff1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022prometheus probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-benign-metrics\u0022, \u0022INT-upstream\u0022, \u0022INT-sqli-tag-only-metrics\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Sonde m\u00e9triques Prometheus\u0022, \u0022Upstream\u0022, \u0022Tag WAF SQLi (m\u00e9triques)\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022prometheus probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics\u0022, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":127},{"id":4686818,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50048,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/runpod-volume\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022727d3e1b2a02e4553478c2346d7c65677bff6678\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 138, \u0022payload_entropy\u0022: 5.142282357716284, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222849f8b003786e3ad63a1d9c97b777cae1b1293c\u0022, \u0022event_fingerprint\u0022: \u0022dc78af29a6671291eb46008c8b9f3f03c692040b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00221ee8ea8761f04cd35c5f433d4381ed0c\u0022, \u0022path_pattern_hash\u0022: \u00223695efe742966e7745e3e8823a627438\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/runpod-volume\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/runpod-volume\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ea6bb226b189d0f2bba8878b0dea1721ae96b17\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/runpod-volume\/.env\u0022, \u0022request_line\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/runpod-volume\/.env\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/runpod-volume\/.env\u0022, \u0022request_line\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/runpod-volume\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/runpod-volume\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":138},{"id":4686817,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":49954,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":16,"waf_tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/.env.bak","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00224a5fcefd2e38e385c845c219c16c9499f238dece\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.11494014167555, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 54, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b0972f64ba9296a474b7944a155f09b6ca344f69\u0022, \u0022event_fingerprint\u0022: \u0022b4a13923810c54dd62e1853b1b023fb50c1d8205\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 270, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 54}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002267b324a11b3d7bf88f3ab9d85728485e\u0022, \u0022path_pattern_hash\u0022: \u0022e884c8b66a9cc0dbcd8816b9898313a2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 54}, \u0022payload_preview\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.bak\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.bak\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002225aed8915dbc8cc8f84d46ffe05896c87325fb75\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.bak\u0022, \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.bak\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 54}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 54, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.bak\u0022, \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":128},{"id":4686816,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50222,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/settings","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022e8f9f693bfd4e746949fc40b20697455a0237f2e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.057270620888327, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u0022210da1eb4bd7012f39355e21501239d833760eb7\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022138072270a0cd0cb28cdec8f62a6ee94\u0022, \u0022path_pattern_hash\u0022: \u0022516d279ce4f4fa3aeff988f417de0090\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/settings\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/settings HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/settings\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/settings HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224326496c3a61def0f45684405d5b9b2a408bc06e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/settings\u0022, \u0022request_line\u0022: \u0022GET \/api\/settings HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/settings\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/settings\u0022, \u0022request_line\u0022: \u0022GET \/api\/settings HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/settings\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/settings HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":132},{"id":4686815,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50348,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/config","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00223383ee1869025a20c1a7d96b3e957f247716cc75\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 5.089765590194601, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b2027556d87d77525efbc881d52c671d2aa7a9aa\u0022, \u0022event_fingerprint\u0022: \u002202517e2a58ff7b5d4ec6783b1c6f24c064b5d4e3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022200a6064cd8f6632ee86688b813e8d1a\u0022, \u0022path_pattern_hash\u0022: \u002201d0ea696869632ca69da251f24e240d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227d0f34f97193d99016361fc6ee4af65c700c0472\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\u0022, \u0022request_line\u0022: \u0022GET \/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\u0022, \u0022request_line\u0022: \u0022GET \/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_probe_config\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_probe_config\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":126},{"id":4686814,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50380,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/health","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00220bb4da595b0ae9c7552fe95627a4f99f024f8c89\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 5.082577500455584, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a2729e9dc2ef12bd6ebe63405d5056f7c38cac48\u0022, \u0022event_fingerprint\u0022: \u0022777a4dc2be0d07cd4da59e1124a562c49544d387\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00222e2828fb08665738f35c151865530480\u0022, \u0022path_pattern_hash\u0022: \u00220587c50e302cd55b995100e6e49c0789\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/health\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/health\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002249ce5218b95ce56b9ad214ed91c75e9e72be697f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/health\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/health\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/health\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/health\u0022, \u0022evidence_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_probe_health\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_probe_health\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":126},{"id":4686813,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50174,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/files\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00225c3c9c4ac6cc2bb080d395e76c7aedeb0c656c28\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.105248337879019, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f0d5c22bafeed179f498d93f65e685d900a3bde7\u0022, \u0022event_fingerprint\u0022: \u0022ba29ea92c643e34814bac1cfebda3a2841bc4520\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00221209ba6c983b8730d8eb345d26ba02bc\u0022, \u0022path_pattern_hash\u0022: \u00224d646c08731de49e2b83aa25e9d5dd81\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ddd1b4d02b77c1f2a466559900ed18c1dad15e65\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/.env\u0022, \u0022request_line\u0022: \u0022GET \/files\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/files\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_files\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":4686812,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":49902,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.local","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00221bd3d14a0dcd500ff7a77dd7b961ff8960851334\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.095960821541868, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e7bc79a4713621b663b358c2b22d8f3fa1d52c96\u0022, \u0022event_fingerprint\u0022: \u0022e906ebd03daa96546e7aab52b5d736ad55497139\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 295, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022, \u0022Probe \/.env.local\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00229795bdb3ed0e38d16ba155098d6ba24d\u0022, \u0022path_pattern_hash\u0022: \u0022b9c24fc1b97f40588adfd0796c248786\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.local\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.local\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002256842c0a108ac9bf1ac725b7826ece3f13bd3f83\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.local\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.local\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":130},{"id":4686811,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50064,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/start.sh","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sh\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u002213414c0ce390fd2e188cbf67a6546cb3998c0392\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.079679887128853, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223b265b166d289b0768c4553dcb8eb857f84b4f57\u0022, \u0022event_fingerprint\u0022: \u00221d624328eb963c82c81e746e8260634d5045aa02\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00225b6b3e914d82d35015985b9c10c95f28\u0022, \u0022path_pattern_hash\u0022: \u0022dd7971449f9a8eed758cc8ec48e096eb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/start.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/start.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/start.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/start.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002244215a172d28f07c16e01c7a32b8dd9cfb1c982b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/start.sh\u0022, \u0022request_line\u0022: \u0022GET \/start.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/start.sh\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/start.sh\u0022, \u0022request_line\u0022: \u0022GET \/start.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/start.sh\u0022, \u0022evidence_snippet\u0022: \u0022GET \/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":128},{"id":4686810,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50046,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":14,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/opt\/runpod\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022486bd37407b8948e38b389d5cced6bd82dbf6636\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.088305068722983, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222849f8b003786e3ad63a1d9c97b777cae1b1293c\u0022, \u0022event_fingerprint\u0022: \u0022788640c3f53f01900e68cfe46013e7f9168cd657\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00225de279d7261441c8c827d7ee8564201b\u0022, \u0022path_pattern_hash\u0022: \u0022a66557c8eef1d814395ffccaabe3911e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/opt\/runpod\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/opt\/runpod\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228c56eaac2a2a5947d210bfcd13e6b9cf4b0d1630\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/opt\/runpod\/.env\u0022, \u0022request_line\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/opt\/runpod\/.env\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/opt\/runpod\/.env\u0022, \u0022request_line\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/opt\/runpod\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/opt\/runpod\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":135},{"id":4686809,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50308,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/system_stats","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022d981879983216b8a82eb4e8fed1a4b3f3bd7b5ce\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 136, \u0022payload_entropy\u0022: 5.1206639526982, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u0022bab4d4b2833195c512c7c82b77d5e233daef033b\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00226f56f4deaee18b49f7e2b41a0ccb1aae\u0022, \u0022path_pattern_hash\u0022: \u0022480a39357e539536b312ea4e6b47003e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system_stats\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system_stats\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225e63a2744fe0e10510e85091c4f8ed264479e9a2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system_stats\u0022, \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/system_stats\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system_stats\u0022, \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/system_stats\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":136},{"id":4686808,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50026,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.runpod\/config.toml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022toml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00221ef2d3392af9c1e2594e265c2f1fa8ca8078aae7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 139, \u0022payload_entropy\u0022: 5.11612884370109, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002213e7830058c678bae07dec7cb5298925383471f5\u0022, \u0022event_fingerprint\u0022: \u00223ccbb3ad5eb624f56d21da495b745732e6e3b67f\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002293506f7afaa4e51afefed1d2257bbe76\u0022, \u0022path_pattern_hash\u0022: \u002278cb3606b1b30af106d36df0e816e464\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.runpod\/config.toml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.runpod\/config.toml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c559588c925d7fc8a46ec5bc8d6614b65dd961ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.runpod\/config.toml\u0022, \u0022request_line\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/.runpod\/config.toml\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.runpod\/config.toml\u0022, \u0022request_line\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/.runpod\/config.toml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.runpod\/config.toml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":139},{"id":4686807,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50224,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022fa6ec570ddd88ec1d41872a8e6f3ad484b0698f4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.09139867236185, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u002233f2a5ccada6facc26acdbf99409def0c8622a93\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022637b280b6cea3056dd257a6180bd08a9\u0022, \u0022path_pattern_hash\u0022: \u0022e627cc4c251255a75074b8f0130897a0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002217943b6302f62f5410f470586c6026026ba82278\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/env\u0022, \u0022request_line\u0022: \u0022GET \/api\/env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/env\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/env\u0022, \u0022request_line\u0022: \u0022GET \/api\/env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":127},{"id":4686806,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50198,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/files\/workspace\/start.sh","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022sh\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00222857746d71a4743b53af399d700d6c2ee836b452\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 144, \u0022payload_entropy\u0022: 5.117909763415114, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d570fea14d8c197320076d986a2180b36349e384\u0022, \u0022event_fingerprint\u0022: \u0022dd7d005cd68111b7327f139699c6714e29b06153\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022a2fe4d38202a871b3035ef7381a59939\u0022, \u0022path_pattern_hash\u0022: \u0022d731847c730f2589307d35ad39aad21d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/start.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\/workspace\/start.sh\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002286073f4f569755aaffc7f7c1ef295590de9090c3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/start.sh\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/files\/workspace\/start.sh\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\/workspace\/start.sh\u0022, \u0022request_line\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/files\/workspace\/start.sh\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/workspace\/start.sh HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_probe_files\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_probe_files\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":144},{"id":4686805,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50332,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/queue","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00220f1d0987aba47e543bbe8d9c11819b3bd14b4995\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.099254048768058, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u00225a21f3a131279f25588de70548209f04ec498c96\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022172551db38868c23fda334bcdda0ed76\u0022, \u0022path_pattern_hash\u0022: \u00223d1cc4ce2f040f076d575f131bcf7395\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/queue\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/queue\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222d54520dc77f68fbef2b275068252b034ff8f75e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/queue\u0022, \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/queue\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/queue\u0022, \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/queue\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":129},{"id":4686804,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":49908,"dst_port":8080,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.production","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022production\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00229b39fa6529cda07275007291b337879405a04c62\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.089215832103828, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ad718e582d46863f8997848402203c7d9f0b563a\u0022, \u0022event_fingerprint\u0022: \u0022e3c4252da545ab7f8af13f66a303b2abc7c91d0c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 295, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022, \u0022Probe \/.env.production\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022be52dee7de04fc4e62469f095a89808c\u0022, \u0022path_pattern_hash\u0022: \u0022a397c8c79032c8a19624fdccf1ae5680\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.production\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.production\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fd5916c0f9242ceb17b0a4f9b6cc7aeb1a2545d5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.production\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.production\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":135},{"id":4686803,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50260,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/terminals","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00224c49064bb42c7ed170700b40b5c02c2c4e077e9b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.099518651374573, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 37, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u00228f4c904a579eff6434cc709514aa01aba11ce663\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 62, \u0022precision_signals\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 52.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002259e58b1310f60f52270898f368a53f9d\u0022, \u0022path_pattern_hash\u0022: \u00228c8320d5f0b2d90f7ab21832d3aaaed1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 37}, \u0022payload_preview\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/terminals\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/terminals\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ac44857b1c40907871ab2b12cfdc3a2e9896a4ef\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/terminals\u0022, \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/terminals\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 37}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 37, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-beh-scan-burst\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Beh Scan Burst\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/terminals\u0022, \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/terminals\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:808\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 52 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":133},{"id":4686802,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50418,"dst_port":8080,"service":"http","classification":"swagger_probe","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/openapi.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30\u0022, \u0022emulator_response_len\u0022: 222, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022fbefa43472a7125a037371a7b329a0d19e799762\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.083050919813251, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b03df15184f2fd72067c64fbb6368a0824c46409\u0022, \u0022event_fingerprint\u0022: \u0022e90af35e434eafcf92c553f295b714f44aaa17b6\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-benign-path-cap\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab swagger_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022c0c18a2d8e0259545af92cfcd4c0aaac\u0022, \u0022path_pattern_hash\u0022: \u0022a41941b8b4af1fefc5445fd387a888c3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/openapi.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/openapi.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab swagger_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220e10a0778421700d322c3795e786ac7ba1a58cf9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/openapi.json\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022swagger probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openapi.json\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab swagger_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab swagger_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-benign-path-cap\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Chemin b\u00e9nin connu\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/openapi.json\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022swagger probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openapi.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_probe_openapi_json\u0022, \u0022http_swagger_probe\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_probe_openapi_json\u0022, \u0022http_swagger_probe\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":132},{"id":4686801,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50416,"dst_port":8080,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/docs","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00221baff95c2d0e31059720a3716ad5b5a34b61a207\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 124, \u0022payload_entropy\u0022: 5.091726782360795, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223b265b166d289b0768c4553dcb8eb857f84b4f57\u0022, \u0022event_fingerprint\u0022: \u00225d171d097a4bddc9ace90b80c3d99830e7509e4d\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022ae6b87f79791486589656e70e6ff2354\u0022, \u0022path_pattern_hash\u0022: \u0022a2557b8d5a9637c813b7d4a0495197d3\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a3991aa00bb597c59e23a3f64ecf0515c14a3b01\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docs\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 68 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 68 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":124},{"id":4686800,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50102,"dst_port":8080,"service":"http","classification":"scanner_vuln","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/docker-compose.yml","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022yml\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022284ed5c0f139fefe102f54c41fbd64a2a9a5ffd9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 138, \u0022payload_entropy\u0022: 5.154670081952129, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223b265b166d289b0768c4553dcb8eb857f84b4f57\u0022, \u0022event_fingerprint\u0022: \u0022576b0d22fb4a57ce7f43fcca3cd027b8a701251b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022confidence\u0022: 0.46, \u0022classification_confidence\u0022: 0.46, \u0022precision_score\u0022: 55, \u0022precision_signals\u0022: [\u0022pat-0251\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0251\u0022], \u0022matched_patterns\u0022: [\u0022pat-0251\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/docker-compose.yml\u0022], \u0022pattern_ids\u0022: [\u0022pat-0251\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022vuln_scanner\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 46.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00227b42e01919f6a91d13ba6689e0c3c9f4\u0022, \u0022path_pattern_hash\u0022: \u002296d32e90d2f8019607590c30e27c0bff\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docker-compose.yml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docker-compose.yml\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220fc49fe52dcad00069afadd78e5911da63383159\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docker-compose.yml\u0022, \u0022request_line\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022attack_vector\u0022: \u0022scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docker-compose.yml\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 46 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 46, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0251\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0251\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docker-compose.yml\u0022, \u0022request_line\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docker-compose.yml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/docker-compose.yml HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 46 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 46 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":138},{"id":4686799,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50288,"dst_port":8080,"service":"http","classification":"probe_api","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/spec","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022f090885f278abd608c17d2a40cb2b392dffcf756\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.0655441729518484, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 40.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 40.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002264d6e257c33c3e1428fa7d4091466a3b007aabb3\u0022, \u0022event_fingerprint\u0022: \u0022bce4c880ad70e06d6cb9aa4a1acc51fc47670f82\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 55, \u0022precision_signals\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 40.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002260574aeee15255ddcb59c2883c169b35\u0022, \u0022path_pattern_hash\u0022: \u002233132cb5c4063b31464a0c7ba122eb34\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/spec\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/spec\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222dd2e3a84b9352d9534627bed3d207254ea7b401\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/spec\u0022, \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022probe api \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/spec\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 43\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 40.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/spec\u0022, \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022probe api \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/spec\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":128},{"id":4686798,"ip":"163.192.217.96","ts":"2026-10-19 10:54:19.000000","proto":"tcp","src_port":50396,"dst_port":8080,"service":"http","classification":"probe_healthz","waf_score":3,"waf_tags":"[\u0022950601:k8s-metrics\u0022]","http_method":"GET","http_target":"\/healthz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u0022bc862a33cabbfc1a7e7c8c72fe1a9ca84be78240\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.0931531489486535, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228d8ae30fd8db7db68a184ce9fc9a3edf0e1d01eb\u0022, \u0022event_fingerprint\u0022: \u0022303fd14bd5a912156e93290150a3dc75fbaf0056\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-benign-health\u0022, \u0022INT-benign-k8s-healthz\u0022, \u0022INT-benign-path-cap\u0022], \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00228167d458fed7d5522e824d352cb554d6\u0022, \u0022path_pattern_hash\u0022: \u002215a99506b4e1757dce48edc0f607d4a4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/healthz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022], \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/healthz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022], \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe69ab3d171a763302858cecd6fdd8c3f71b9aa1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/healthz\u0022, \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022attack_vector\u0022: \u0022probe healthz \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/healthz\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-benign-health\u0022, \u0022INT-benign-k8s-healthz\u0022, \u0022INT-benign-path-cap\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Benign Health\u0022, \u0022Benign K8S Healthz\u0022, \u0022Chemin b\u00e9nin connu\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/healthz\u0022, \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022probe healthz \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/healthz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:8080\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950601:k8s-metrics\u0022, \u0022http_probe_healthz\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950601:k8s-metrics\u0022, \u0022http_probe_healthz\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":127}],"total_events":59}