167.99.70.147

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "2bbcb90ba7ea8c250dd8b71a2e43bf90f7d31126",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 473,
    "payload_entropy": 5.5070113382192,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "e398b1b1d3ed8d716f57a48051bcdf440e2ce40a",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
        "payload_hash": "d771cc2d24c84c5aab56b58be62bf4b2",
        "path_pattern_hash": "741caf654772eba68a9137cc0e0f4d13"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
    "method": "GET",
    "path": "\/%00snapshot\/%00.env",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00snapshot\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtm",
    "payload_snippet": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
    "evidence": {
        "method": "GET",
        "path": "\/%00snapshot\/%00.env",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00snapshot\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtm",
        "payload_snippet": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ad8ff5b40bca8404280e6b4cbbb4df636b79e3d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00snapshot\/%00.env",
        "request_line": "GET \/%00snapshot\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00snapshot\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00snapshot\/%00.env",
            "request_line": "GET \/%00snapshot\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00snapshot\/%00.env",
        "evidence_snippet": "GET \/%00snapshot\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "3adb863cebb1297040f5b458b2808f1771805761",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 466,
    "payload_entropy": 5.498512065541086,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "cd37027fecbe6425d9df4ee9cab769868eb74bb8",
    "event_fingerprint": "b8715a9db6c2d0f325d4935092327738d2eee43c",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
        "payload_hash": "70beaf42c436f1c56b8063b3d8b41e9c",
        "path_pattern_hash": "a7ff115ce973bdc180b671a8dadeecfa"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "method": "GET",
    "path": "\/shop\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/shop\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,a",
    "payload_snippet": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "evidence": {
        "method": "GET",
        "path": "\/shop\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/shop\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,a",
        "payload_snippet": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "757df61386afc8cf8d055e63468e0db8010cfd4d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/shop\/%252eenv",
        "request_line": "GET \/shop\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shop\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/shop\/%252eenv",
            "request_line": "GET \/shop\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shop\/%252eenv",
        "evidence_snippet": "GET \/shop\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "http_probe_shop",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "96dceb1b3362e0472eed049459cdb027944a7632",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 490,
    "payload_entropy": 5.513676353438282,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "a1a8569c9ccb5af81f1495a3f7f44c23425baad1",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
        "payload_hash": "303f7187dfafc46d740e51c4c5d71c49",
        "path_pattern_hash": "75e7d2f84be51bf2a83fb0e212fb3aee"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
    "method": "GET",
    "path": "\/%00slack\/%00.env",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00slack\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html",
    "payload_snippet": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
    "evidence": {
        "method": "GET",
        "path": "\/%00slack\/%00.env",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00slack\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html",
        "payload_snippet": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "609a2ee5462647b27e09ce91a8fd7423161e7f2d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00slack\/%00.env",
        "request_line": "GET \/%00slack\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00slack\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00slack\/%00.env",
            "request_line": "GET \/%00slack\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00slack\/%00.env",
        "evidence_snippet": "GET \/%00slack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "7292c1cdaebf01fcc9cb807397c0dc8c2ef6928b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 471,
    "payload_entropy": 5.50757740634193,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "05c1fba52cc1a36b8b8395539f1afd7238ed2244",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
        "payload_hash": "95a6979af48e70a2977572f95c6d40b1",
        "path_pattern_hash": "2c6d20ed43cc2b0c95f6de3fb409a826"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android ",
    "method": "GET",
    "path": "\/%00spring\/%00.env",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00spring\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+",
    "payload_snippet": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
    "evidence": {
        "method": "GET",
        "path": "\/%00spring\/%00.env",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00spring\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+",
        "payload_snippet": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "95c46c8f15a371bad27952f88e94ed5b7973b763",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00spring\/%00.env",
        "request_line": "GET \/%00spring\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spring\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00spring\/%00.env",
            "request_line": "GET \/%00spring\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spring\/%00.env",
        "evidence_snippet": "GET \/%00spring\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "58db6312560b73a2784c3b284729ee9f55c771a9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 468,
    "payload_entropy": 5.498480681194531,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "a348f6d5e11098578f45d8a8de770e6be1e3be88",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
        "payload_hash": "cec4760a9f79619ee4c59fce86ed02b0",
        "path_pattern_hash": "be422b583d6bb447af2e5920623adbd5"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
    "method": "GET",
    "path": "\/shared\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/shared\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
    "payload_snippet": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
    "evidence": {
        "method": "GET",
        "path": "\/shared\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/shared\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
        "payload_snippet": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6d26e573759398e5268348016563c2f2a7a04bb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/shared\/%252eenv",
        "request_line": "GET \/shared\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shared\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/shared\/%252eenv",
            "request_line": "GET \/shared\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shared\/%252eenv",
        "evidence_snippet": "GET \/shared\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "8cebf2f6df488f732fa7ab43eaa5e6dcebb0d764",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 502,
    "payload_entropy": 5.551155269609897,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "adaa864d7ef06c85582020013d7d4e77358b454a",
    "event_fingerprint": "e39923b704b57c79355fc827555415d304d54275",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
        "payload_hash": "ebecead7f788b0b19d558178940e2a0d",
        "path_pattern_hash": "5f58cf2c1d7a1b4a3939c6f709950c89"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0",
    "method": "GET",
    "path": "\/sites\/%252eenv",
    "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/sites\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccep",
    "payload_snippet": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0",
    "evidence": {
        "method": "GET",
        "path": "\/sites\/%252eenv",
        "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/sites\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccep",
        "payload_snippet": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5007ce98693a7f9630cde969dfe4381e0dc1d865",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sites\/%252eenv",
        "request_line": "GET \/sites\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sites\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sites\/%252eenv",
            "request_line": "GET \/sites\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sites\/%252eenv",
        "evidence_snippet": "GET \/sites\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "http_sharepoint_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "8ef0ad53bd01309c4ddbf7753baeba5b4aa200b6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 469,
    "payload_entropy": 5.506752961359917,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "d53437099e909d6c79be307f405b7a06e0d9b419",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
        "payload_hash": "24e9faddee5ea735446c3795b44c14c4",
        "path_pattern_hash": "4e3247870479282f491a30d02ae6882d"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
    "method": "GET",
    "path": "\/sender\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/sender\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
    "payload_snippet": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
    "evidence": {
        "method": "GET",
        "path": "\/sender\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/sender\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
        "payload_snippet": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5088a60ea85a2f61764812c8173598fef4ec12bf",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sender\/%252eenv",
        "request_line": "GET \/sender\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sender\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sender\/%252eenv",
            "request_line": "GET \/sender\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sender\/%252eenv",
        "evidence_snippet": "GET \/sender\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "29de0ef6d9a00143fde5c2ffd808b6a87ad0d373",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 462,
    "payload_entropy": 5.503678173406324,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "aee9121f8e71f6398615c9316725a3077d12a814",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "2a936af417d2688746bb2b2d89b146b4",
        "path_pattern_hash": "edb2642bd6691692729a21a641b4146f"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
    "method": "GET",
    "path": "\/search\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/search\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
    "payload_snippet": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "evidence": {
        "method": "GET",
        "path": "\/search\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/search\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
        "payload_snippet": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9b68a699ec48da16f0ab1814914a2bfcc02039af",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/search\/%252eenv",
        "request_line": "GET \/search\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/search\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/search\/%252eenv",
            "request_line": "GET \/search\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/search\/%252eenv",
        "evidence_snippet": "GET \/search\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "a31e31f780255dee19939ff4c4c931e7ea582931",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 467,
    "payload_entropy": 5.49738770749774,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "b008a27a74f28600ac0655b50967122dae821f83",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
        "payload_hash": "60ae19e1b63593e60be948161dc73bd3",
        "path_pattern_hash": "ae33bb40bf54c7ef2a007e55a6cd96e4"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
    "method": "GET",
    "path": "\/%00spa\/%00.env",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00spa\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
    "payload_snippet": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
    "evidence": {
        "method": "GET",
        "path": "\/%00spa\/%00.env",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00spa\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
        "payload_snippet": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "08820110292f7e24ce53c2edfb9104506232b3f9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00spa\/%00.env",
        "request_line": "GET \/%00spa\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spa\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00spa\/%00.env",
            "request_line": "GET \/%00spa\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spa\/%00.env",
        "evidence_snippet": "GET \/%00spa\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "0f1e7e384663336f9a58365d7fe273832ff0efc7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 493,
    "payload_entropy": 5.565019370035363,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "cb06a728f9067606aab64d6466571aae4b80ae72",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
        "payload_hash": "b3d142534525b16182f258baf543a908",
        "path_pattern_hash": "f16dd53185ca29099a3b520427f267fb"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozil",
    "method": "GET",
    "path": "\/%73%63%61%6e%6e%65%72\/.%65%6e%76",
    "query_string": "v=PiO7k",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1",
    "request_sample": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/h",
    "payload_snippet": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozil",
    "evidence": {
        "method": "GET",
        "path": "\/%73%63%61%6e%6e%65%72\/.%65%6e%76",
        "query_string": "v=PiO7k",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1",
        "request_sample": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/h",
        "payload_snippet": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozil",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c42b84331d90780a3ed7ac5253acdf40b13633e2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%63%61%6e%6e%65%72\/.%65%6e%76",
        "request_line": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozil",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%63%61%6e%6e%65%72\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%63%61%6e%6e%65%72\/.%65%6e%76",
            "request_line": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%63%61%6e%6e%65%72\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%63%61%6e%6e%65%72\/.%65%6e%76?v=PiO7k HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozil",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "7da3cb2865b0ac2c8c3aa69e84fc355e2a20132c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 423,
    "payload_entropy": 5.459777796231267,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "15d0ae6e12bd71fbe1d1984832be4e5486f879a3",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
        "payload_hash": "0487955965ffad06c17e1b52f65d1c2d",
        "path_pattern_hash": "1a3763ab3026e023079539e7f251a2d6"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
    "method": "GET",
    "path": "\/snapshot\/%252eenv",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/snapshot\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,",
    "payload_snippet": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
    "evidence": {
        "method": "GET",
        "path": "\/snapshot\/%252eenv",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/snapshot\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,",
        "payload_snippet": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9cb7d5106868d26193ed9d01c26bb21177e543e5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/snapshot\/%252eenv",
        "request_line": "GET \/snapshot\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/snapshot\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/snapshot\/%252eenv",
            "request_line": "GET \/snapshot\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/snapshot\/%252eenv",
        "evidence_snippet": "GET \/snapshot\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "62d56260d496e4143b1606e55e4c4e3a01f0bd56",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 461,
    "payload_entropy": 5.503462886015881,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "655bf25aa46db52d624256bd0cbfb1a5edfff9c3",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "25d9f52f6557db3f26168c95eb4508bc",
        "path_pattern_hash": "bd7c3ee670490d8f06e7e473d66aa395"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "method": "GET",
    "path": "\/slave\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/slave\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
    "payload_snippet": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "evidence": {
        "method": "GET",
        "path": "\/slave\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/slave\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
        "payload_snippet": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cf2d40c4cae9e253b83ea51b5f96c1a2561d987c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/slave\/%252eenv",
        "request_line": "GET \/slave\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slave\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/slave\/%252eenv",
            "request_line": "GET \/slave\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slave\/%252eenv",
        "evidence_snippet": "GET \/slave\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "170dbad875eb26167f2d4f109cda477f20c45746",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 440,
    "payload_entropy": 5.547637160755001,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "903c292a12135a245dbae59aec6dd3606689cfca",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
        "payload_hash": "d29f169418779d4ea3890fa62fe12bee",
        "path_pattern_hash": "a146b7cd200caedeb1714a674105c91f"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "method": "GET",
    "path": "\/%73%74%61%66%66\/.%65%6e%76",
    "query_string": "v=Qbk63",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1",
    "request_sample": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "evidence": {
        "method": "GET",
        "path": "\/%73%74%61%66%66\/.%65%6e%76",
        "query_string": "v=Qbk63",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1",
        "request_sample": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2c5908afdf9102824c2612ab5474633013bc7b4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%74%61%66%66\/.%65%6e%76",
        "request_line": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%74%61%66%66\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%74%61%66%66\/.%65%6e%76",
            "request_line": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%74%61%66%66\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%74%61%66%66\/.%65%6e%76?v=Qbk63 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "e6a72556def4be2c122f4b6011ab5ca304907d23",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 461,
    "payload_entropy": 5.502874317232898,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "91dd0ee5bada5f8728347c98a4dc35beded1a6ab",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "e239876f82da4bf5c7faef50572fed80",
        "path_pattern_hash": "4eff2f889d32ce6de617f8723c179817"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "method": "GET",
    "path": "\/%00sql\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00sql\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
    "payload_snippet": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "evidence": {
        "method": "GET",
        "path": "\/%00sql\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00sql\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
        "payload_snippet": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a8ca9f6152faf75aff53037184d0a29f428f13fa",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00sql\/%00.env",
        "request_line": "GET \/%00sql\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sql\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00sql\/%00.env",
            "request_line": "GET \/%00sql\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sql\/%00.env",
        "evidence_snippet": "GET \/%00sql\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "73e4f77070047708941cc98752a85f1cb4f71e5e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 465,
    "payload_entropy": 5.4946410311568,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "7550e718d3b77284da23f7e1eee6b70c776cd011",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
        "payload_hash": "ec1c98046d215bc39423cbe5880da6da",
        "path_pattern_hash": "4e48ebd35f7b13d137e227c84d1a630c"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
    "method": "GET",
    "path": "\/spa\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/spa\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,ap",
    "payload_snippet": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
    "evidence": {
        "method": "GET",
        "path": "\/spa\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/spa\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,ap",
        "payload_snippet": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "361151a38fbbdd51acd14356a5414e8f7d721db7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/spa\/%252eenv",
        "request_line": "GET \/spa\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spa\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/spa\/%252eenv",
            "request_line": "GET \/spa\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spa\/%252eenv",
        "evidence_snippet": "GET \/spa\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "eef994bdc61cdd08b6c7a5e447cc52067dab4706",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 476,
    "payload_entropy": 5.50195716250781,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "801161b4be3078ac7925757222354bd9d66bf636",
    "event_fingerprint": "b035d8e37bdc81ed9e41e4b367ee7d2fcc4374b7",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
        "payload_hash": "e29e6ebefe585238f0275482735fe811",
        "path_pattern_hash": "ef25c0f4cf5572f3b358c58c3f4f3e1b"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
    "method": "GET",
    "path": "\/schema\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
    "waf_tags": [
        "950076:sqli-19",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "sqli-19",
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/schema\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/x",
    "payload_snippet": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "evidence": {
        "method": "GET",
        "path": "\/schema\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
        "waf_tags": [
            "950076:sqli-19",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "sqli-19",
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/schema\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/x",
        "payload_snippet": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b390253c394df1c43eb67e25e985ceeb0e2b70da",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/schema\/%252eenv",
        "request_line": "GET \/schema\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/schema\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/schema\/%252eenv",
            "request_line": "GET \/schema\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/schema\/%252eenv",
        "evidence_snippet": "GET \/schema\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950076:sqli-19",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "fdaa1085fddfbf29b02d6716b928086989366d2d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 477,
    "payload_entropy": 5.498111458178568,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "c1c7d90906226656fb2d284df9c624e2d74be385",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
        "payload_hash": "34cb2da83041a9070527ff7b2e516813",
        "path_pattern_hash": "3cbfa3726c95d2ab112901f5d566c6db"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "method": "GET",
    "path": "\/service\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/service\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/",
    "payload_snippet": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "evidence": {
        "method": "GET",
        "path": "\/service\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/service\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/",
        "payload_snippet": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5eb808012a300164445f952d882cfa34f5c352ea",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/service\/%252eenv",
        "request_line": "GET \/service\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/service\/%252eenv",
            "request_line": "GET \/service\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/%252eenv",
        "evidence_snippet": "GET \/service\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "dc7710d64e63798d9328aedba641363fe354dc09",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 468,
    "payload_entropy": 5.514370293099093,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "fe9a5efae330bc81ddf8bea33f97b30ded15fb9d",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
        "payload_hash": "8676a74b7d5745296159bfde14407ced",
        "path_pattern_hash": "2e4c3c33871ab4ae5c150e0345aa88bb"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "method": "GET",
    "path": "\/slack\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/slack\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
    "payload_snippet": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "evidence": {
        "method": "GET",
        "path": "\/slack\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/slack\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
        "payload_snippet": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d591e076cbc613c091b6b8b15e99052310d841e7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/slack\/%252eenv",
        "request_line": "GET \/slack\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slack\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/slack\/%252eenv",
            "request_line": "GET \/slack\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slack\/%252eenv",
        "evidence_snippet": "GET \/slack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "b0d93eb2ad5c6bc3ee28798390b1c0afd12e5e82",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 472,
    "payload_entropy": 5.501854426942519,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "90930556b6bc14cf246944e21007ba75f6b20455",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
        "payload_hash": "9bc5eaaff2dc273d3cf2a3415db74dd0",
        "path_pattern_hash": "a813131e0b29d65e47623fede9c07956"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
    "method": "GET",
    "path": "\/%00software\/%00.env",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00software\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml",
    "payload_snippet": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
    "evidence": {
        "method": "GET",
        "path": "\/%00software\/%00.env",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00software\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml",
        "payload_snippet": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0e9406c82688f436f0f9c617855d779b200e547f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00software\/%00.env",
        "request_line": "GET \/%00software\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00software\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00software\/%00.env",
            "request_line": "GET \/%00software\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00software\/%00.env",
        "evidence_snippet": "GET \/%00software\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "95415060a0c05feabf1ee3001801e273d6bd5fe0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 500,
    "payload_entropy": 5.557381652023914,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "554462419a684bbb521b589998ba69480a00f999",
    "event_fingerprint": "aa5f79f05e352f6fb0f95cbb5087ca3e8a95e1dc",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
        "payload_hash": "e9671b2c8b20ede4e9b05e8d7eab7aa8",
        "path_pattern_hash": "b1a2e4ae45f1069dfa0ac04ee663b55a"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; ",
    "method": "GET",
    "path": "\/sso\/%252eenv",
    "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/sso\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:",
    "payload_snippet": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
    "evidence": {
        "method": "GET",
        "path": "\/sso\/%252eenv",
        "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/sso\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:",
        "payload_snippet": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b9d8aef0d76e3685a7d06667c7819a37dece5f09",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sso\/%252eenv",
        "request_line": "GET \/sso\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sso\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sso\/%252eenv",
            "request_line": "GET \/sso\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sso\/%252eenv",
        "evidence_snippet": "GET \/sso\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "http_probe_sso",
        "http_saml_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "53d2e24ee09addc5af59d3dd6003ee8fecf02850",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 452,
    "payload_entropy": 5.5092140335593305,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "cca124b27dc69d26b52048c9d97173727f42e599",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
        "payload_hash": "3d7c34c3b591e6e348f055d91adad9de",
        "path_pattern_hash": "538e13e0dc7d8b569cbbb93d587d7df1"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
    "method": "GET",
    "path": "\/spring\/%252eenv",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/spring\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml",
    "payload_snippet": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
    "evidence": {
        "method": "GET",
        "path": "\/spring\/%252eenv",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/spring\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml",
        "payload_snippet": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9a87873ddfd7ad0797d2ba6b7337d250c9e859a7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/spring\/%252eenv",
        "request_line": "GET \/spring\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spring\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/spring\/%252eenv",
            "request_line": "GET \/spring\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spring\/%252eenv",
        "evidence_snippet": "GET \/spring\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "6faaea708cc1e901a22159f739f263ec0f7e3d6d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 479,
    "payload_entropy": 5.494752955478179,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "1e4b14977cefc1e310a5ee1554ed009f071d175e",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
        "payload_hash": "5afd75d757310a3559db701555f2747b",
        "path_pattern_hash": "5e622ed006dfe03ec8f982a8ab46dc5e"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "method": "GET",
    "path": "\/%00sources\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00sources\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applicatio",
    "payload_snippet": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "evidence": {
        "method": "GET",
        "path": "\/%00sources\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00sources\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applicatio",
        "payload_snippet": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "222dad42f0bced95c646c05a400679b08c1487ea",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00sources\/%00.env",
        "request_line": "GET \/%00sources\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sources\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00sources\/%00.env",
            "request_line": "GET \/%00sources\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sources\/%00.env",
        "evidence_snippet": "GET \/%00sources\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "0ed02dc913e04fa44a5d48c8c6324c3d77e14e2e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 422,
    "payload_entropy": 5.459819902499374,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "9b0d580227cd2eaf10b3a1597d4fe987bc2611e1",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
        "payload_hash": "ec25e4c96ebe9ec3db4b3936d9f5df0e",
        "path_pattern_hash": "b0819f04e8e5d027d4e1ea176ed71036"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_6",
    "method": "GET",
    "path": "\/%00spark\/%00.env",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00spark\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*",
    "payload_snippet": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_6",
    "evidence": {
        "method": "GET",
        "path": "\/%00spark\/%00.env",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00spark\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*",
        "payload_snippet": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_6",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6eb0b3f9577ea7a087b96070682d5faa8eb0ab75",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00spark\/%00.env",
        "request_line": "GET \/%00spark\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_6",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spark\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00spark\/%00.env",
            "request_line": "GET \/%00spark\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00spark\/%00.env",
        "evidence_snippet": "GET \/%00spark\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_6",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "1ef9190178f39ad6dcc3f83e73f8582b54f6a18c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 504,
    "payload_entropy": 5.549089613493635,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "509a13bdde5b9d205e0734de318edd9fc7a81095",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
        "payload_hash": "ab2707290abb77f5815007c5ad7120b8",
        "path_pattern_hash": "5444cace217485ab023b8b232b399092"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
    "method": "GET",
    "path": "\/session\/%252eenv",
    "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/session\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
    "payload_snippet": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
    "evidence": {
        "method": "GET",
        "path": "\/session\/%252eenv",
        "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/session\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
        "payload_snippet": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b6c0a2234bce6a1aca7d7775a32a845f6673bd7a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/session\/%252eenv",
        "request_line": "GET \/session\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/session\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/session\/%252eenv",
            "request_line": "GET \/session\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/session\/%252eenv",
        "evidence_snippet": "GET \/session\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "9714ba1ab716833072e0b98116d1fc181a016250",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 432,
    "payload_entropy": 5.445093154241068,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "3da4246f323f2ccad07113266fac3dee0544f381",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
        "payload_hash": "885365564c6cd46e11fc6e57c10c0e35",
        "path_pattern_hash": "7e8d86aee65f517d4c2617a7fb287fa6"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "method": "GET",
    "path": "\/%00space\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00space\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,im",
    "payload_snippet": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "evidence": {
        "method": "GET",
        "path": "\/%00space\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00space\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,im",
        "payload_snippet": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "07c1b4a6b0e4de8de43294193fc26a4c779ab93c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00space\/%00.env",
        "request_line": "GET \/%00space\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00space\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00space\/%00.env",
            "request_line": "GET \/%00space\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00space\/%00.env",
        "evidence_snippet": "GET \/%00space\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "4242e0f0a843845158285e767f39eae0a121a1ab",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 470,
    "payload_entropy": 5.489165971388447,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "1dcb4e88d4423a4e50470436454af531ec7e98c9",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
        "payload_hash": "691fab91b2ec3d0a5062e3d56faf8c69",
        "path_pattern_hash": "000595636a94918633e17bdc97179313"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte",
    "method": "GET",
    "path": "\/services\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/services\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+x",
    "payload_snippet": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte",
    "evidence": {
        "method": "GET",
        "path": "\/services\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/services\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+x",
        "payload_snippet": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1a27b9f345a3b991a18961b4aeac41c6f9d06182",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/services\/%252eenv",
        "request_line": "GET \/services\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/services\/%252eenv",
            "request_line": "GET \/services\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/%252eenv",
        "evidence_snippet": "GET \/services\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "0fbfd14c7c0c3414d485453cd6f846152c4c40ff",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 433,
    "payload_entropy": 5.450879173290123,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "78d224089b1b28c6d23df06c9083e8c92589b01d",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
        "payload_hash": "c90b7741575704c4e908a249d567b9b8",
        "path_pattern_hash": "a245cc6a7260a051a80dace1babcbd69"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "method": "GET",
    "path": "\/%00source\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00source\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,i",
    "payload_snippet": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "evidence": {
        "method": "GET",
        "path": "\/%00source\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00source\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,i",
        "payload_snippet": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "675f171699a0e2c4d1a1cbcb69a5abe7282e8d54",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00source\/%00.env",
        "request_line": "GET \/%00source\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00source\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00source\/%00.env",
            "request_line": "GET \/%00source\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00source\/%00.env",
        "evidence_snippet": "GET \/%00source\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "c6a754a8da7d0a32c32c0393834c908c0e422a66",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 473,
    "payload_entropy": 5.5049192944797385,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "9be46fd54f954f5be69033604c5c6d46d5953c23",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
        "payload_hash": "2b57b06b01fa9ca946835e74c038a7ac",
        "path_pattern_hash": "ec2a7393b68204178ee919d0079553c7"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "method": "GET",
    "path": "\/sms\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/sms\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtm",
    "payload_snippet": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "evidence": {
        "method": "GET",
        "path": "\/sms\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/sms\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtm",
        "payload_snippet": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6fb21ec6dd23db79450f57f5d68c0f2202a05b4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sms\/%252eenv",
        "request_line": "GET \/sms\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sms\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sms\/%252eenv",
            "request_line": "GET \/sms\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sms\/%252eenv",
        "evidence_snippet": "GET \/sms\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "816073a492ea3f11258bb608d2fb1127c2db8649",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 464,
    "payload_entropy": 5.4976863549922435,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "648a7d97942dd8de1c62a6c8f53e03267db49e3a",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "bb480a3dcebc6fb10762affa75ad04bf",
        "path_pattern_hash": "6466812d712425629c20f2d9354fd3d1"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "method": "GET",
    "path": "\/%00socket\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00socket\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
    "payload_snippet": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "evidence": {
        "method": "GET",
        "path": "\/%00socket\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00socket\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
        "payload_snippet": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6bf1b91c01e21fd79d78df68876313dce39e8166",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00socket\/%00.env",
        "request_line": "GET \/%00socket\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00socket\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00socket\/%00.env",
            "request_line": "GET \/%00socket\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00socket\/%00.env",
        "evidence_snippet": "GET \/%00socket\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 10,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 525,
    "payload_entropy": 5.470424168755959,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 72,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 58,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "fe230ddaba4ee2b317a45a3cabe50f11c36d1e75",
    "event_fingerprint": "77cd5a641eb6867c57f1ae472125cd6ba50d54a3",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 177,
    "precision_signals": [
        "MITRE-T1499",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "MITRE-T1499",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
        "payload_hash": "ac72fae7d4509c3bb28a00df635fac5c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 3\r\nAccept: text\/html,application\/xhtm",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 3\r\nAccept: text\/html,application\/xhtm",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "50286e1d69aa2bec88fa3e19ca76deb59dfe1506",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "468cc633699324a007c5c7e47266d246438f20fe",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 431,
    "payload_entropy": 5.455976624298752,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "a666f4a94e4a3ef17f03c3c8f72c2c5e8ece2419",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
        "payload_hash": "1309cd22f6892db4e51e9ebdab631cf1",
        "path_pattern_hash": "5db3072bbf12056507e74cb01f1d1555"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
    "method": "GET",
    "path": "\/social\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/social\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,ima",
    "payload_snippet": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "evidence": {
        "method": "GET",
        "path": "\/social\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/social\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,ima",
        "payload_snippet": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9fc62628b5227b876b563088e0517f98c96c21f2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/social\/%252eenv",
        "request_line": "GET \/social\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/social\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/social\/%252eenv",
            "request_line": "GET \/social\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/social\/%252eenv",
        "evidence_snippet": "GET \/social\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "bf582ed08b879a418edce0cb1259859a750865ca",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 471,
    "payload_entropy": 5.573537861254749,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "8192213ce6fba36c1d4fc032d2c7d7f795917eea",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
        "payload_hash": "0a67ce2d82853238c850d77a82af4f2e",
        "path_pattern_hash": "98ef80022adf1be8e15c8bc0ee63e159"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "method": "GET",
    "path": "\/%73%74%61%63%6b\/.%65%6e%76",
    "query_string": "v=8qaG5",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1",
    "request_sample": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+",
    "payload_snippet": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "evidence": {
        "method": "GET",
        "path": "\/%73%74%61%63%6b\/.%65%6e%76",
        "query_string": "v=8qaG5",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1",
        "request_sample": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+",
        "payload_snippet": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "519b57f1b6a1a25bb91c6b5a4e6f0be4adcb9b2a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%74%61%63%6b\/.%65%6e%76",
        "request_line": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%74%61%63%6b\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%74%61%63%6b\/.%65%6e%76",
            "request_line": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%74%61%63%6b\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%74%61%63%6b\/.%65%6e%76?v=8qaG5 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "237dd5c6308d90e63ba9abf221f771ce3d2aec66",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 465,
    "payload_entropy": 5.491615474254185,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "9e01ee10d86170bb61a21b457693350b146771d4",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "f928505ecbf1011e6035136fdc8f1980",
        "path_pattern_hash": "18fcc2a0f3cabe7b28ce07a1995daf4f"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "method": "GET",
    "path": "\/%00scanner\/%00.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00scanner\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
    "payload_snippet": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "evidence": {
        "method": "GET",
        "path": "\/%00scanner\/%00.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00scanner\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
        "payload_snippet": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "beaa6ac03ecb754ab944d4417da20ca6e7be48a0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00scanner\/%00.env",
        "request_line": "GET \/%00scanner\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00scanner\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00scanner\/%00.env",
            "request_line": "GET \/%00scanner\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00scanner\/%00.env",
        "evidence_snippet": "GET \/%00scanner\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "736f2789c9b5001d86c5ae4a65d301505b9a9b28",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 420,
    "payload_entropy": 5.457534292705704,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
    "event_fingerprint": "a8bb56a217abf73f921bef6a6729a8c73031c611",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
        "payload_hash": "bddbe52e8488d38291451ffc14c1b9f3",
        "path_pattern_hash": "8c7c984730f7506e6b9eb56dfffd3708"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
    "method": "GET",
    "path": "\/%00src\/%00.env",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%00src\/%00.env HTTP\/1.1",
    "request_sample": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*",
    "payload_snippet": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
    "evidence": {
        "method": "GET",
        "path": "\/%00src\/%00.env",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%00src\/%00.env HTTP\/1.1",
        "request_sample": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*",
        "payload_snippet": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2e9f4b4a03d8173814678831120b78786f7e6dff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%00src\/%00.env",
        "request_line": "GET \/%00src\/%00.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00src\/%00.env",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%00src\/%00.env",
            "request_line": "GET \/%00src\/%00.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00src\/%00.env",
        "evidence_snippet": "GET \/%00src\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "a410ffa1d6f8369ae6f9d010f657bc71b8b3a9fa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 460,
    "payload_entropy": 5.4999164318864215,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "f6c7e1c785b78931e15e7a4818999ca398a8f327",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "e469a615e20f4a236e1b672d45585509",
        "path_pattern_hash": "7066b123d25079d31597a774f8a2b323"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "method": "GET",
    "path": "\/site\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/site\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
    "payload_snippet": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "evidence": {
        "method": "GET",
        "path": "\/site\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/site\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
        "payload_snippet": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d248a663fa7afc22cada28edbb4c09572784217b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/site\/%252eenv",
        "request_line": "GET \/site\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/site\/%252eenv",
            "request_line": "GET \/site\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/%252eenv",
        "evidence_snippet": "GET \/site\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "b068402ac5e020a93549fab872539a381f352b6e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 479,
    "payload_entropy": 5.504375282406978,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
    "event_fingerprint": "2734914bdbd8b8e37135d5d38d9356400f7a72ce",
    "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 122,
    "precision_signals": [
        "MITRE-T1499"
    ],
    "kb_rule_ids": [
        "MITRE-T1499"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 68
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
        "payload_hash": "e4736cc5fd20fb4fc6fd4c489f11038e",
        "path_pattern_hash": "a4141aca7ef641f911074f6cd57fea28"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 68
    },
    "payload_preview": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "method": "GET",
    "path": "\/scheduler\/%252eenv",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/scheduler\/%252eenv HTTP\/1.1",
    "request_sample": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applicatio",
    "payload_snippet": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "evidence": {
        "method": "GET",
        "path": "\/scheduler\/%252eenv",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/scheduler\/%252eenv HTTP\/1.1",
        "request_sample": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applicatio",
        "payload_snippet": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "48ab6565054e8e583ac5e029fc63aaf059adaab6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/scheduler\/%252eenv",
        "request_line": "GET \/scheduler\/%252eenv HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scheduler\/%252eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 68
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 68,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/scheduler\/%252eenv",
            "request_line": "GET \/scheduler\/%252eenv HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scheduler\/%252eenv",
        "evidence_snippet": "GET \/scheduler\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_path_traversal",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "fe8a82ccd3be008f893ef6ed1ea15c8d253df8b9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 468,
    "payload_entropy": 5.515892053228046,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "e379197cd0a01ed22c695dafca95992f5dfacbdd",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
        "payload_hash": "d20027e8ffccbe108ea2e42893219949",
        "path_pattern_hash": "04e0753173015269e6c9f2c31722c035"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
    "method": "GET",
    "path": "\/social\/%2eenv",
    "query_string": "v=mkcgu",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1",
    "request_sample": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
    "payload_snippet": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
    "evidence": {
        "method": "GET",
        "path": "\/social\/%2eenv",
        "query_string": "v=mkcgu",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1",
        "request_sample": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
        "payload_snippet": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "803e24d8f6ee433bf76bd68a4c836ff077196a43",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/social\/%2eenv",
        "request_line": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/social\/%2eenv",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/social\/%2eenv",
            "request_line": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/social\/%2eenv",
        "evidence_snippet": "GET \/social\/%2eenv?v=mkcgu HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 10,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 497,
    "payload_entropy": 5.486523964423454,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "0afdcad7f01ba7f26b239e8885e8f9ecce42cd36",
    "event_fingerprint": "77cd5a641eb6867c57f1ae472125cd6ba50d54a3",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 177,
    "precision_signals": [
        "MITRE-T1499",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "MITRE-T1499",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
        "payload_hash": "414065ad9e46976e105dcf66662d94a4",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Ge",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
    "waf_tags": [
        "950326:rce-0",
        "950327:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 21\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Ge",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "waf_tags": [
            "950326:rce-0",
            "950327:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 21\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Ge",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1499"
    ],
    "mitre": "T1499",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7aa76ae8988cba3f27fcd4e2f97e0940ad29f887",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Ge",
    "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1499",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1499",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1499",
        "mitre_technique": "T1499",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Ge",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950327:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "2d8735f831afa0a9918fcef8c7284e66357606aa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 474,
    "payload_entropy": 5.566910878657699,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "ba6ebe849f7b617ed5d94c58fb4a1de9f7d4e0cb",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
        "payload_hash": "7fcd018a784a9e0dedace4702df7bde6",
        "path_pattern_hash": "8b3419fef14ed69c33224c45ffd47c5f"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "method": "GET",
    "path": "\/%73%69%67%6e%61%6c\/.%65%6e%76",
    "query_string": "v=l6DAA",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1",
    "request_sample": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xht",
    "payload_snippet": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "evidence": {
        "method": "GET",
        "path": "\/%73%69%67%6e%61%6c\/.%65%6e%76",
        "query_string": "v=l6DAA",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1",
        "request_sample": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xht",
        "payload_snippet": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "15b1f8ef4ef1f8da795788b8bb68fb9a4b79d463",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%69%67%6e%61%6c\/.%65%6e%76",
        "request_line": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%67%6e%61%6c\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%69%67%6e%61%6c\/.%65%6e%76",
            "request_line": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%67%6e%61%6c\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%69%67%6e%61%6c\/.%65%6e%76?v=l6DAA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "763c857d3c64964f525680527407f408192d49eb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 508,
    "payload_entropy": 5.586939513616143,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "8e13860e8f9448a033f0f27a51e0023d1a24e35c",
    "event_fingerprint": "e219cadc0d3cb85d3ad15ce03b992a963aee1a56",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
        "payload_hash": "d7f066159b68f251dda810c1773c6753",
        "path_pattern_hash": "c94e2581d797d0367df300be1b78dc7f"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "method": "GET",
    "path": "\/%73%69%74%65%73\/.%65%6e%76",
    "query_string": "v=co45x",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1",
    "request_sample": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r",
    "payload_snippet": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "evidence": {
        "method": "GET",
        "path": "\/%73%69%74%65%73\/.%65%6e%76",
        "query_string": "v=co45x",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1",
        "request_sample": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r",
        "payload_snippet": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c4028cc1e2eadcf622242dc775741b67170dff9f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%69%74%65%73\/.%65%6e%76",
        "request_line": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%74%65%73\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%69%74%65%73\/.%65%6e%76",
            "request_line": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%74%65%73\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%69%74%65%73\/.%65%6e%76?v=co45x HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "http_sharepoint_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "6394419e82234516cbde3e8dd20e3e772556614c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 490,
    "payload_entropy": 5.5633555724412815,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "f6c90cd5066b7f7496f76772e71bf3342daabc9c",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
        "payload_hash": "ec7fd066feed1e9240f6ed3e6e0811cd",
        "path_pattern_hash": "dea1be2d14c42a2d570fbe2317be6f0e"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "method": "GET",
    "path": "\/%73%65%6e%73%6f%72\/.%65%6e%76",
    "query_string": "v=nMTaK",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1",
    "request_sample": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html",
    "payload_snippet": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "evidence": {
        "method": "GET",
        "path": "\/%73%65%6e%73%6f%72\/.%65%6e%76",
        "query_string": "v=nMTaK",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1",
        "request_sample": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html",
        "payload_snippet": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "380c4509aa7170e7c3bbf1029800e53629f2109a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%65%6e%73%6f%72\/.%65%6e%76",
        "request_line": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%65%6e%73%6f%72\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%65%6e%73%6f%72\/.%65%6e%76",
            "request_line": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%65%6e%73%6f%72\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%65%6e%73%6f%72\/.%65%6e%76?v=nMTaK HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 8,
    "http_query_params": 1,
    "http_path_depth": 2,
    "http_path_ext": "%65%6e%76",
    "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
    "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
    "http_target_hash": "aa5a57b1a31e4a3c0204c2ed8c239ca6e7070689",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 497,
    "payload_entropy": 5.599949313362159,
    "port_category": "registered",
    "org": "DigitalOcean, LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 14061,
    "country": "SG",
    "dst_port": 12378,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 67,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca",
    "event_fingerprint": "2d6b82ff21e34d9f03fc1768f994f3e6bad9b023",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 127,
    "precision_signals": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 67
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SG",
        "asn": 14061,
        "org": "DigitalOcean, LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
        "payload_hash": "fc523125f8a286673c2f7621342a083e",
        "path_pattern_hash": "0861c61d85aef9f0a58307b965ad0e2c"
    },
    "target_context": {
        "dst_port": 12378,
        "service": "http",
        "service_name": "http",
        "risk_score": 67
    },
    "payload_preview": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo",
    "method": "GET",
    "path": "\/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
    "query_string": "v=G2dYh",
    "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1",
    "request_sample": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: te",
    "payload_snippet": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo",
    "evidence": {
        "method": "GET",
        "path": "\/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
        "query_string": "v=G2dYh",
        "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1",
        "request_sample": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: te",
        "payload_snippet": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9c5ee71cd44fff64f66542b88e010b932492d111",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
        "request_line": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
        "port": 12378,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo",
    "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
    "target_port_label": "12378 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 67
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 67,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12378,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
            "request_line": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
            "port": 12378,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%73%69%74%65%6d%61%70%73\/.%65%6e%76",
        "evidence_snippet": "GET \/%73%69%74%65%6d%61%70%73\/.%65%6e%76?v=G2dYh HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo",
        "target_port_label": "12378 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}