165.154.120.253

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "c5eaaf44abf7ef0e21c51360858a96c9359b4ea4",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.938795003120691,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5042,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8d1cd4f9a67bca62e2db0c7d3ad08557b097a2e4",
    "event_fingerprint": "f0e45f384ad89f7ff0f37252b42dca5611588aa5",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "d9da58252a4fe2ea61b40b1e2cbcb36f",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 5042,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9e52b01ec2cb1e1d82041d153cf680a9f3247ff7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5042,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "5042 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5042,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5042,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5042 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "c5eaaf44abf7ef0e21c51360858a96c9359b4ea4",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.923276337346147,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5042,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8d1cd4f9a67bca62e2db0c7d3ad08557b097a2e4",
    "event_fingerprint": "5ac6389775f50eb30c40b45346353b679435a9ff",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "76e397cfa357dcf8aaa66b45d0c6bca1",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 5042,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cde2c2c06c44dbb19dced58d99a4b19ee9509457",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5042,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "5042 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5042,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5042,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5042 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "c5eaaf44abf7ef0e21c51360858a96c9359b4ea4",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.982396293385163,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5042,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8d1cd4f9a67bca62e2db0c7d3ad08557b097a2e4",
    "event_fingerprint": "817095572726d5e528a58e0822217cd6a47ce00f",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "76cbcb2e935002f2d562523d5ebdf2ce",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 5042,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "150050fcc08d8e680a6c3543e35eeb3d88aa1eb7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5042,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "5042 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5042,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5042,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5042 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5042 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "fcad32b22177ecd45301b65aeb5c1b063b53b7ec",
    "http_host_hash": "c5eaaf44abf7ef0e21c51360858a96c9359b4ea4",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.42915648492046,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5042,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "3755f0e113eaabfaa24d74f83d427165e7b98ff5",
    "event_fingerprint": "a462403619eafccc704242e57bf0fab805f23d25",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6df3443d9b5295ac97a7b09cb37b6f64",
        "payload_hash": "1eecd47df7aedae73aa4e9aea4087641",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5042,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc1b43c10cb79b8fa5defa46cec2e6c5c0b7e998",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36",
        "port": 5042,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome",
    "attack_vector": "exploit attempt \u00b7 via HTTP:5042 \u00b7 (tentative d'exploit)",
    "target_port_label": "5042 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5042,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome\/102.0.339 Safari\/537.36",
            "port": 5042,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:5042 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5042\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/554.39 (KHTML, like Gecko) Chrome",
        "target_port_label": "5042 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "TH",
    "dst_port": 9381,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1da14223e5e11c296bedebf0e23df54ce1c5caa5",
    "event_fingerprint": "389ff6215ed7638bd431fbe1077212cb0f6a4b59",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9381,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5932753c501ddace02fad43a7ad51774556ffa24",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 9381
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 9381 \u00b7 (sonde \/ probe)",
    "target_port_label": "9381",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9381,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 9381
        },
        "attack_vector": "Sonde port \u00b7 port 9381 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "9381",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9381"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9381",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.736703825012331,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "TH",
    "dst_port": 9381,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f8b67e05fd929435fa94b83f16ab9ffb9ea514a6",
    "event_fingerprint": "d644cdec93b6945d3a1e69bbfe6e75002308554d",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "7a91188403a89810e167a0d29d9946e2",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9381,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\u0013\ufffd\u0003\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\u0013\u0013\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\u0013\ufffd\u0003\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\u0013\u0013\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdb\\it!o\ufffd&\u0012;8\ufffd\ufffdI\ufffd)\u000b\ufffd\ufffd\ufffdI\ufffd\u001f\u02a5\ufffd\ufffd\\3\ufffdg",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\u0013\ufffd\u0003\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\u0013\u0013\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "87b561f9a6beca748431cf3dff734bf39ca3143a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\u0013\ufffd\u0003\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\u0013\u0013\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 9381,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\ufffd\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:9381 \u00b7 (sonde \/ probe)",
    "target_port_label": "9381 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 9381,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\u0013\ufffd\u0003\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\u0013\u0013\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 9381,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:9381 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u058b\ufffd)H\ufffd\u05aa\ufffd7\ufffd\\ye;, \ufffd\n?\ufffd\ufffd\ufffd\ufffd\\WE\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd4\ufffdSH\u01bbx&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "9381 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "9381"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9381",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 9381,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "26816b01e2c3eee7ef2e47fcc19546d1add12e79",
    "event_fingerprint": "8767c983ed69b5b239ab188399c5038cff7bb6db",
    "classification_reason": "Type \u00ab port_9381_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9381,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_9381_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a7f37e6b7d28927ebf5141ffa9ee73fd4be7aa9f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 9381,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 9381 tcp \u00b7 via HTTP:9381 \u00b7 (sonde \/ probe)",
    "target_port_label": "9381 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_9381_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_9381_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9381,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 9381,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 9381 tcp \u00b7 via HTTP:9381 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "9381 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9381"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9381"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "TH",
    "dst_port": 9381,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1da14223e5e11c296bedebf0e23df54ce1c5caa5",
    "event_fingerprint": "389ff6215ed7638bd431fbe1077212cb0f6a4b59",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9381,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2ee780758e69148418eaf5fa0692b20b281dc2ca",
    "protocol_details": {
        "port": 9381
    },
    "attack_vector": "Sonde port \u00b7 port 9381 \u00b7 (sonde \/ probe)",
    "target_port_label": "9381",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9381,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 9381
        },
        "attack_vector": "Sonde port \u00b7 port 9381 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9381",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9381"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9e6bb96df0a0a468bab47dd3ff4b1748499b7452",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.953748353111855,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2651,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ead0376e7f55b3f84f88fc17fd200bc897cabcd0",
    "event_fingerprint": "05a58b46ee2a364daba130c294e23f7df49facd4",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "684d311ad7f580732eb61a9a911a1bb6",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 2651,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "45eb63c700c18a27cdbc4dae4ad6fc1bb90f74e6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2651,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "2651 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2651,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2651,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2651 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2651"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9e6bb96df0a0a468bab47dd3ff4b1748499b7452",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.894399213550653,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2651,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ead0376e7f55b3f84f88fc17fd200bc897cabcd0",
    "event_fingerprint": "7f039692e4f30fdc8a9c163b08991fe1dc7eca30",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "47cf274a1d59203f849dddc71d488f90",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 2651,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "99ae4f932b25b7adf495b4d674305cbf8e2fec62",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2651,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "2651 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2651,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2651,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2651 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2651"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "eaedb44a380e66d96e47d023ab72189483b825bf",
    "http_host_hash": "9e6bb96df0a0a468bab47dd3ff4b1748499b7452",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.435233598647077,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2651,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f520362cd9ae70edcb7fa886938b05098c6515e3",
    "event_fingerprint": "3695989125abf23c54ab0cb60c3cddc2af1bd77a",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "01fe1e5fc07d91c1647bf7db1bddd88f",
        "payload_hash": "99251adb0bb660351d8d9452f48d148e",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2651,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "215a9a62c0f7941531c88066ee59a6986e24bfab",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36",
        "port": 2651,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome",
    "attack_vector": "exploit attempt \u00b7 via HTTP:2651 \u00b7 (tentative d'exploit)",
    "target_port_label": "2651 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2651,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome\/57.0.1773 Safari\/537.36",
            "port": 2651,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:2651 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/599.54 (KHTML, like Gecko) Chrome",
        "target_port_label": "2651 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2651"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "9e6bb96df0a0a468bab47dd3ff4b1748499b7452",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.910147062847384,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2651,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ead0376e7f55b3f84f88fc17fd200bc897cabcd0",
    "event_fingerprint": "3d085ec38d6f3bc5877d9f7f5bcfa1b0ab48566a",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "d0568ad935024f3e1b92975144d31a21",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 2651,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "edd287fa66414a24105f9d66b0778b8098d55603",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2651,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "2651 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2651,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2651,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2651 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2651\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2651 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2651"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "19835519e70948ed3b0d4a0ff5e9c3da48fba623",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.9447861737727825,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7395,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "5ae37a224ccd3316ef205bd213393e397167b406",
    "event_fingerprint": "96910f9b8aca8875e99c54ec6a78f1a269f83144",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "737edf0088030592bb2eb5e9816b9adb",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 7395,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e2f3d01d1d995bd6701668e6857e1252290422f2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7395,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "7395 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7395,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7395,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7395 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7395"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "19835519e70948ed3b0d4a0ff5e9c3da48fba623",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.929315437363456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7395,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "5ae37a224ccd3316ef205bd213393e397167b406",
    "event_fingerprint": "9ee2eb34989b3dbad70fecad8059f3d6ccaf93e8",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "310d3973ffc667d4538a9186636d4f86",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 7395,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "024de7d84ac1f3e3e34e531788e7f5e6e67d2a43",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7395,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "7395 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7395,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7395,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7395 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7395"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "19835519e70948ed3b0d4a0ff5e9c3da48fba623",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.988387464037254,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7395,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "5ae37a224ccd3316ef205bd213393e397167b406",
    "event_fingerprint": "f81034eff2a7f25f607e1164c139d4a60b873ef8",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "692a83678217c72d6ec331c71a8783e2",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 7395,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "06487cd8510da4838ed9410aef0fd7c89adfde66",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7395,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "7395 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7395,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7395,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7395 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7395 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7395"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "14686d9d31b94f03f6a4b214ae889d63982d5500",
    "http_host_hash": "19835519e70948ed3b0d4a0ff5e9c3da48fba623",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 212,
    "payload_entropy": 5.389009750563073,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7395,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "016f8ac63bf56e2fa65b82c83d674727a9b66f62",
    "event_fingerprint": "b527c634c47186a8e75128206a56f929c677bcda",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ffc852373b06f8164234c955c60bf994",
        "payload_hash": "563f8b958fb63eefb0a127ecae64537a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7395,
        "service": "http",
        "service_name": "http",
        "risk_score": 46
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "49cd03b9a544afdc7b7f54d93c5af4af90042b4d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36",
        "port": 7395,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like",
    "attack_vector": "exploit attempt \u00b7 via HTTP:7395 \u00b7 (tentative d'exploit)",
    "target_port_label": "7395 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7395,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like Gecko) Chrome\/69.0.1150 Safari\/537.36",
            "port": 7395,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:7395 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7395\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/566.41 (KHTML, like",
        "target_port_label": "7395 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7395"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "71db00aa9bdbb730dcc6f3541e934164ca40aa70",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.954668018993708,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2968,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c9035a75b0fedc81671752d0f59f9a19200e6ad2",
    "event_fingerprint": "4e35044cb5f6f9a73b1189735a336aaacb15c3ec",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "381733b7a27aa8e8f3c0bdfb5cdb1675",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 2968,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1d732cc1446343802f0485d14337accc68ff8d3b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2968,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "2968 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2968,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2968,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2968 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2968"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "71db00aa9bdbb730dcc6f3541e934164ca40aa70",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.99826930925818,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2968,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c9035a75b0fedc81671752d0f59f9a19200e6ad2",
    "event_fingerprint": "4be4044fc8980770f2a78947d8c9e9b8d39049af",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "eb20c0c98aac7d4badb9cd087d820d1f",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 2968,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "70ddbb5b5c88793924fe3ab261810c3d0d8cea77",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2968,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "2968 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2968,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2968,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2968 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2968"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "71db00aa9bdbb730dcc6f3541e934164ca40aa70",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.939276337346148,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2968,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c9035a75b0fedc81671752d0f59f9a19200e6ad2",
    "event_fingerprint": "dfd81ee8ae8e6f72ffffbd575d68a298bd6a6ebf",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "881dfb9ae9635d9f25eb8dc0fdca9b48",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 2968,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "03c0a1852fa39df91f31fdd5e1cc341869964144",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2968,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "2968 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2968,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2968,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2968 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2968 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2968"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "ac4ba452bf0c99a8145ab6d239b83ddbb8ea2ed4",
    "http_host_hash": "71db00aa9bdbb730dcc6f3541e934164ca40aa70",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.431925406565997,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2968,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "872a3f84c538c02ecfad200f17b7fb752387e396",
    "event_fingerprint": "61670e33abda283f7c30cad0bca91c67e6d628b8",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 47
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b908676bdddc30f8a8747bb2c5aafe9b",
        "payload_hash": "af8d02f0775736e4f1028a1fc4635be3",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2968,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cdaf0e55289fdb3c53ebba2b449805113fc74ab2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36",
        "port": 2968,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome",
    "attack_vector": "exploit attempt \u00b7 via HTTP:2968 \u00b7 (tentative d'exploit)",
    "target_port_label": "2968 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 47
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2968,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome\/64.0.2511 Safari\/537.36",
            "port": 2968,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:2968 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2968\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/569.53 (KHTML, like Gecko) Chrome",
        "target_port_label": "2968 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2968"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "11587a8af2db010e451cee49a9d645b96b258e17",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.9447861737727825,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8eb4a1cd0705b7aadad2792daf8ab650ff7aa73d",
    "event_fingerprint": "c50a480f697af13ea3abbfb5356cf42216d7c926",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "54a149384e61654406442cf2831a574a",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 7034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "df5c7975b75775bb65f43921d46b4ce2870990ec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "7034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "11587a8af2db010e451cee49a9d645b96b258e17",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.929315437363456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8eb4a1cd0705b7aadad2792daf8ab650ff7aa73d",
    "event_fingerprint": "eb9a32876ddb49ca9872eaa6f50eb2dcf349c698",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "5f82e5204d05973e86f0afd4dec8dc90",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 7034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "78253e41143801adea90f61fe45819b14475040a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "7034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "11587a8af2db010e451cee49a9d645b96b258e17",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.988387464037254,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7034,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8eb4a1cd0705b7aadad2792daf8ab650ff7aa73d",
    "event_fingerprint": "074937dd017c170c46e3c51fab9f88a42973ec13",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "e53a829c7b6a468728624d49bca56cdc",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 7034,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "29a5997aee87e3352eb39c51444186898dc10a70",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "7034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7034 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "2c863ae329e98ce8a850f7bb8036d8e98969e442",
    "http_host_hash": "11587a8af2db010e451cee49a9d645b96b258e17",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 212,
    "payload_entropy": 5.391200285689064,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7034,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "726a475d0765f751cf57a0ac566ffb098daa16fc",
    "event_fingerprint": "43e47fa1ce06c19b17c75d54cdbd53116cc34dcf",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b3e549efa1c969566dae14cd025e458f",
        "payload_hash": "88a3f856dac586975152909a6fa6f357",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7034,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f16f7f7841eb2d0e9b98eba68e5a6362c3d4d10e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36",
        "port": 7034,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like",
    "attack_vector": "exploit attempt \u00b7 via HTTP:7034 \u00b7 (tentative d'exploit)",
    "target_port_label": "7034 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 48
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like Gecko) Chrome\/75.0.1777 Safari\/537.36",
            "port": 7034,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:7034 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7034\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit\/545.48 (KHTML, like",
        "target_port_label": "7034 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "a493f0d931f8a21cff70f82d86950b8908c8c3f4",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.923276337346147,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2865,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4fd693bb0e50bb79de231b0ac05c5d9bebd60ab3",
    "event_fingerprint": "a13ad70df28c308fb2399013a3a3757791ad267b",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "b8fac87e268e13d29463933494ebbf1e",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 2865,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cd2614e25e50ea8a597f48b5c09fc7ce527b8a79",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2865,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "2865 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2865,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2865,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2865 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2865"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "a493f0d931f8a21cff70f82d86950b8908c8c3f4",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.982396293385163,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2865,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4fd693bb0e50bb79de231b0ac05c5d9bebd60ab3",
    "event_fingerprint": "d5b471411ad293dc4fbb38d0e1ae8ac3f4f81ee4",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "955632448bfddc316c94e9b6d1586947",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 2865,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9fec3b017cda8d9102868336d05ad80f05d3f425",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2865,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "2865 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2865,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2865,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2865 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2865"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6b2486f2794f8b9eb5aa4a7b913380b6531eea88",
    "http_host_hash": "a493f0d931f8a21cff70f82d86950b8908c8c3f4",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 209,
    "payload_entropy": 5.4284365020483545,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2865,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52d0f463c6253a12fdb998567e6163360c3a2ead",
    "event_fingerprint": "c2280c07472f4fd78e34a2ca2afdc1c9d7a3226a",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bdd1f2af6ca1ea23e6a76430092ca02a",
        "payload_hash": "6f5c371c8c2024a87bc7f79ab813842d",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2865,
        "service": "http",
        "service_name": "http",
        "risk_score": 45
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Ge",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Ge",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Ge",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8111fab915091203e51de127bc501e9ee539c626",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36",
        "port": 2865,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Ge",
    "attack_vector": "exploit attempt \u00b7 via HTTP:2865 \u00b7 (tentative d'exploit)",
    "target_port_label": "2865 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2865,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Gecko) Chrome\/78.0.1657 Safari\/537.36",
            "port": 2865,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:2865 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit\/584.40 (KHTML, like Ge",
        "target_port_label": "2865 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2865"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "a493f0d931f8a21cff70f82d86950b8908c8c3f4",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.938795003120691,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 2865,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4fd693bb0e50bb79de231b0ac05c5d9bebd60ab3",
    "event_fingerprint": "2ec5dea2905c61461ab5f707b26a018049fe5efe",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "54416757c25b626d677096b74fa81adb",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 2865,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4eb59dd02426f8c441c4017093e64dd3bf4c8b8e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 2865,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "2865 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2865,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 2865,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2865 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2865\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "2865 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2865"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 25,
    "payload_entropy": 3.7834651896016456,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "TH",
    "dst_port": 18881,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bdde6c103af4afce1425deaf112d15a3b629cae1",
    "event_fingerprint": "b1eee02fb89353693c27be15edf58395d00261cc",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 18881,
        "risk_score": 44
    },
    "payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
    "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "evidence": {
        "request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
        "payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d5d69271432cb246f9a11283a876b19a72d93221",
    "protocol_details": {
        "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
        "port": 18881
    },
    "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
    "attack_vector": "Sonde port \u00b7 port 18881 \u00b7 (sonde \/ probe)",
    "target_port_label": "18881",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18881,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
            "port": 18881
        },
        "attack_vector": "Sonde port \u00b7 port 18881 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
        "target_port_label": "18881",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18881"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:18881",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 247,
    "payload_entropy": 5.761820783469075,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "tls",
    "app_proto": "tls",
    "asn": 135377,
    "country": "TH",
    "dst_port": 18881,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "efbffcb3cfc7a0b7d462b924a7367e5c454121cd",
    "event_fingerprint": "1d8cb4d4ba08bf3bad2dc84326e5a488dedd0c7f",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "payload_hash": "db6162034e3604b4bb0ec436f6876f57",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 18881,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyjbE6\ufffd\ufffd\u0019\ufffd_x\ufffd\ufffd\ufffd.\u0002H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\b\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd\u0014\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyjbE6\ufffd\ufffd\u0019\ufffd_x\ufffd\ufffd\ufffd.\u0002H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\b\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd\u0014\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 p}\ufffd.x\u0481\/\ufffd\u001a\ufffd\u0000\ufffd0\ufffd\ufffd.7y\ufffdK\ufffd\u0018\ufffd\ufffdH\ufffd\ufffd\ufffdce!",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyjbE6\ufffd\ufffd\u0019\ufffd_x\ufffd\ufffd\ufffd.\u0002H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\b\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd\u0014\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2c2e9ef010de537aaaccce326d1687199bfc7576",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyjbE6\ufffd\ufffd\u0019\ufffd_x\ufffd\ufffd\ufffd.\u0002H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\b\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd\u0014\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 18881,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdyjbE6\ufffd\ufffd\ufffd_x\ufffd\ufffd\ufffd.H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:18881 \u00b7 (sonde \/ probe)",
    "target_port_label": "18881 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 18881,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyjbE6\ufffd\ufffd\u0019\ufffd_x\ufffd\ufffd\ufffd.\u0002H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\b\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd\u0014\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 18881,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:18881 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdyjbE6\ufffd\ufffd\ufffd_x\ufffd\ufffd\ufffd.H\ufffdi \ufffd\ufffd[i\ufffdTm\ufffd\ufffd\ufffd u\ufffdL\ufffdN\ufffd\ufffd\ufffd\\\ufffd\"n\ufffdgN\ufffd\ufffd\ufffd\ufffd\ufffd\u035dT^\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "18881 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "18881"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:18881",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 74,
    "payload_entropy": 4.819344967782759,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 18881,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "6afd2f3b671f55fa573bacb05ca033b805c79006",
    "event_fingerprint": "7b979e9f0c77a3de0f093bdd7090f5561a9fb3b8",
    "classification_reason": "Type \u00ab port_18881_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
        "payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 18881,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.29.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.29.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab port_18881_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c170c42a78f386b215339654c8fb63407aa4cdb8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.29.0",
        "port": 18881,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
    "attack_vector": "port 18881 tcp \u00b7 via HTTP:18881 \u00b7 (sonde \/ probe)",
    "target_port_label": "18881 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_18881_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_18881_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18881,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.29.0",
            "port": 18881,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 18881 tcp \u00b7 via HTTP:18881 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
        "target_port_label": "18881 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18881"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:18881"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "botnet_http_ua_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": null,
    "app_proto": null,
    "asn": 135377,
    "country": "TH",
    "dst_port": 18881,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bdde6c103af4afce1425deaf112d15a3b629cae1",
    "event_fingerprint": "b1eee02fb89353693c27be15edf58395d00261cc",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 18881,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6469862a93397114fe5eabd2dbe3edf7309ec41e",
    "protocol_details": {
        "port": 18881
    },
    "attack_vector": "Sonde port \u00b7 port 18881 \u00b7 (sonde \/ probe)",
    "target_port_label": "18881",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18881,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 18881
        },
        "attack_vector": "Sonde port \u00b7 port 18881 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "18881",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18881"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "4e58a3c70f8c6789f44735d655ce67258faa8c8e",
    "http_host_hash": "03f3b768e3c417347d24555ba8f0bf165e8b8f65",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 206,
    "payload_entropy": 5.418299322721173,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 210,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b13ba53acc923adba032d6c2870b76e6e33a08bf",
    "event_fingerprint": "8a5aa213e1ae6a9a8f1291fc5c559ef88b18f63f",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 47
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d01ec865238d1f8af9bcc6d91adc4be9",
        "payload_hash": "28ac1377304392d8bac0a40042388477",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 210,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6f565b0a7ef511de60998a15ac88f7a3a1cd5587",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36",
        "port": 210,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko",
    "attack_vector": "exploit attempt \u00b7 via HTTP:210 \u00b7 (tentative d'exploit)",
    "target_port_label": "210 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 47
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 210,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko) Chrome\/90.0.1143 Safari\/537.36",
            "port": 210,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:210 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Mozilla\/5.0 (Windows NT 8_2; Win64; x64) AppleWebKit\/545.42 (KHTML, like Gecko",
        "target_port_label": "210 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "210"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "03f3b768e3c417347d24555ba8f0bf165e8b8f65",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.898114361124334,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 210,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6d7daaa89572158a6dbc75b02aca90586f23fe0c",
    "event_fingerprint": "541396ed1a78e572a4600d4e7561921ef8c5c210",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "9d32ae314d1dffa746fc29ee5bf2451a",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 210,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a292cab85687862ac3d4f3b3ff5ca65bb702ed2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 210,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "210 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 210,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 210,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "210 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "210"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "03f3b768e3c417347d24555ba8f0bf165e8b8f65",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.942064461710921,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 210,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6d7daaa89572158a6dbc75b02aca90586f23fe0c",
    "event_fingerprint": "de10cedb56c51f40e4f7dc91aeb043fb6152481d",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "b29a3c20686b067ebf6c1a5d2e4118e7",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 210,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d8d9e5413aff3ff39e83252547922650eef84a39",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 210,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "210 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 210,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 210,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "210 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "210"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "03f3b768e3c417347d24555ba8f0bf165e8b8f65",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 124,
    "payload_entropy": 4.882235553218089,
    "port_category": "well_known",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 210,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6d7daaa89572158a6dbc75b02aca90586f23fe0c",
    "event_fingerprint": "8ba8509d90d59db1df29454e9f49b98e5f03862f",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "ccbb56adf41f4a1fa68f87db7b02b071",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 210,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8d3c28832575e9dd5629e88561da1b66f48842ec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 210,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "210 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 210,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 210,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:210 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:210\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "210 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "210"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "e2cf2c5a7cea72ba602042e7d2fba046a88e0e79",
    "http_host_hash": "08d390b6121bb719114123548c87ee8246e49eff",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 211,
    "payload_entropy": 5.404646592739276,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5802,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "49aee2d5d6d4d7a538c4c832c57524cf3b7b2dc6",
    "event_fingerprint": "10492543eba62b8bf8f5892d7d04203b0cb000fb",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 44
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c448b5b2cd1bc3e41b2d2013ae1ef4ab",
        "payload_hash": "1e7f0b3b25b8e7dd11dcc6ac21bd450a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5802,
        "service": "http",
        "service_name": "http",
        "risk_score": 44
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fae6ab00fcbd82dd228e517965cdbd2e4bb51401",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36",
        "port": 5802,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like",
    "attack_vector": "exploit attempt \u00b7 via HTTP:5802 \u00b7 (tentative d'exploit)",
    "target_port_label": "5802 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5802,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like Gecko) Chrome\/84.0.254 Safari\/537.36",
            "port": 5802,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:5802 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/558.39 (KHTML, like",
        "target_port_label": "5802 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5802"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "08d390b6121bb719114123548c87ee8246e49eff",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.938795003120691,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5802,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "bc5060dc9731c29ff2facfb7abd4fe02e3471dd3",
    "event_fingerprint": "6472296c7fb53342b2fc89402908d9ae07e5d98e",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "55638b5b403a34e80ebdfcfd8b34095c",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 5802,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c888d0f863b59251192302dcae3c3a8f39d810b5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5802,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "5802 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5802,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5802,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5802 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5802"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "08d390b6121bb719114123548c87ee8246e49eff",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.982396293385163,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5802,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "bc5060dc9731c29ff2facfb7abd4fe02e3471dd3",
    "event_fingerprint": "0dfb1d1189a4620a28b3c79ae8c9582de47a5b67",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "a792d75fbf7d9031a13fe58688e164d0",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 5802,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "612452afd3b9a77f6bb85c08aceeafb2b1bd2a3d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5802,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "5802 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5802,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5802,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5802 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5802"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "08d390b6121bb719114123548c87ee8246e49eff",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.923276337346147,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 5802,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "bc5060dc9731c29ff2facfb7abd4fe02e3471dd3",
    "event_fingerprint": "99734480734d66390ab2353774ccc5cf3c0188f5",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "c90f8f4c88c9f80d5accd9fa48190a9e",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 5802,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eb983d2af59a2db020d81ce7fab078c03ddb09de",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 5802,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "5802 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5802,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 5802,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5802 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5802\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "5802 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5802"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d71fef7a6a3d928f382952982ff4b173f3f29d7b",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.938795003120691,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7062,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0a3e25a8312242cbd3e893291436001686ad0667",
    "event_fingerprint": "682f492f689f471bb8e075094adcb943ee6d8d35",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "eed6348de3b12a14d02b3996dc001384",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 7062,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "28f608db382eaf70e152dcebb6ada53085993c91",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7062,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "7062 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7062,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7062,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7062 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7062"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d71fef7a6a3d928f382952982ff4b173f3f29d7b",
    "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 4.982396293385163,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7062,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0a3e25a8312242cbd3e893291436001686ad0667",
    "event_fingerprint": "7a4aed2b7fb23ab46f3f1dc538b2b4d1194e0378",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 92,
    "precision_signals": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-sitemap",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "fee2c5cb3c652c9532abd0ba7a1cf877",
        "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
    },
    "target_context": {
        "dst_port": 7062,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/sitemap.xml",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/sitemap.xml HTTP\/1.1",
    "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/sitemap.xml",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "656c8404d1b2f70d559a6bc2840118fc1f193803",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sitemap.xml",
        "request_line": "GET \/sitemap.xml HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7062,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
    "target_port_label": "7062 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7062,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-sitemap",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate sitemap.xml",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sitemap.xml",
            "request_line": "GET \/sitemap.xml HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7062,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
        "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7062 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7062"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "d71fef7a6a3d928f382952982ff4b173f3f29d7b",
    "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 125,
    "payload_entropy": 4.923276337346147,
    "port_category": "registered",
    "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
    "service": "http",
    "app_proto": "http",
    "asn": 135377,
    "country": "TH",
    "dst_port": 7062,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0a3e25a8312242cbd3e893291436001686ad0667",
    "event_fingerprint": "8a0b3c73674a07db749f07ebba71e6888acd8377",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-robots",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "TH",
        "asn": 135377,
        "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "f83f9034f4c9645d207225662a96fb16",
        "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
    },
    "target_context": {
        "dst_port": 7062,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/robots.txt",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET \/robots.txt HTTP\/1.1",
    "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/robots.txt",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1595"
    ],
    "mitre": "T1595",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60d89f44b77acdd44c62273710dff5d2c2012521",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/robots.txt",
        "request_line": "GET \/robots.txt HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 7062,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
    "target_port_label": "7062 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7062,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-robots",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate robots.txt",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1595",
        "mitre_technique": "T1595",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/robots.txt",
            "request_line": "GET \/robots.txt HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 7062,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7062 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
        "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7062\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
        "target_port_label": "7062 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7062"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_ua_suspicious"
    ]
}