{"ip":"170.9.255.3","exported_at":"2026-10-28T23:21:13+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":65,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"monitor","confidence":0.58,"risk_breakdown":{"waf":32,"classification":80,"behavior":0,"geo":0,"protocol":43,"novelty":25},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"T1499","top_mitre_count":363,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)","campaign_hint_fr":null,"confidence_breakdown":{"waf":32,"classification":80,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":46,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":58,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499"],"tags_summary":["MITRE-T1499"],"attack_vector":"http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/metrics","protocol_details":{"http_method":"GET","http_path":"\/metrics","request_line":"GET \/metrics HTTP\/1.1","http_user_agent":"WebSiphon\/next-0.1","port":3001,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/metrics \u00b7 UA WebSiphon\/next-0.1 \u00b7 HTTP:3001","evidence_snippet":"GET \/metrics HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:3001","target_port_label":"3001 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 50 % \u2014 2 tag(s) WAF","classification_reason":"Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%","classification_reason_label_fr":"Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%","confidence_factors_fr":"Confiance 58 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF","payload_preview":"GET \/metrics HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:3001","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"3.255.9.170.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":5030480,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48446,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022]","http_method":"GET","http_target":"\/metrics","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020\u0022, \u0022emulator_response_len\u0022: 154, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00227edfc244708a7b5c7d4b4385c178aa8e03afde7f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.065313727269205, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229a58105315bbe9fef479a5c586080df416c73989\u0022, \u0022event_fingerprint\u0022: \u002216089b5045881b5d76c09a606137de911d8c26bb\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0266\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/metrics\u0022], \u0022pattern_ids\u0022: [\u0022pat-0266\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00224d2199ca1b1d30967d9b1e9ae8167298\u0022, \u0022path_pattern_hash\u0022: \u0022b4bbca6caf5247626ee41b68231d40e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bddf407d0eb4afcd887c1d3f68d3fc045faf4256\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/metrics\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/metrics\u0022, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":127},{"id":5030479,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48476,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/openapi.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30\u0022, \u0022emulator_response_len\u0022: 222, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022fbefa43472a7125a037371a7b329a0d19e799762\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.049034063785426, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223509e02747596cc7b5b06bb8a9897fa573e49a4b\u0022, \u0022event_fingerprint\u0022: \u00220fbef0ca741c67e181845ea5cc4f8566e4e5bcdf\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0267\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/openapi.json\u0022], \u0022pattern_ids\u0022: [\u0022pat-0267\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022482d327838d9a96c9e4e4c5bb96cbc3d\u0022, \u0022path_pattern_hash\u0022: \u0022a41941b8b4af1fefc5445fd387a888c3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/openapi.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/openapi.json\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225c1c334e89ccce9b416f7afa4958110af3a6185d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/openapi.json\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/openapi.json\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/openapi.json\u0022, \u0022request_line\u0022: \u0022GET \/openapi.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/openapi.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/openapi.json HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_probe_openapi_json\u0022, \u0022http_swagger_probe\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_probe_openapi_json\u0022, \u0022http_swagger_probe\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":132},{"id":5030478,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48428,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/health","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00220bb4da595b0ae9c7552fe95627a4f99f024f8c89\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 5.046940794140718, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002237fe69fa821dbf005977e0cdd48298c2981584ab\u0022, \u0022event_fingerprint\u0022: \u002221df56f778d7d3a93bc5d39fc4c4e20d7dd0b599\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002271cbe2fc304d8faa8505690aefbfc0df\u0022, \u0022path_pattern_hash\u0022: \u00220587c50e302cd55b995100e6e49c0789\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/health\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/health\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022665d403190d68765897edb078a35eddefbe36fb3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/health\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/health\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/health\u0022, \u0022request_line\u0022: \u0022GET \/health HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/health\u0022, \u0022evidence_snippet\u0022: \u0022GET \/health HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_probe_health\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022http_probe_health\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":4,"bytes_in":126},{"id":5030477,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48460,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/docs","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00221baff95c2d0e31059720a3716ad5b5a34b61a207\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 124, \u0022payload_entropy\u0022: 5.055515290460206, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022590fdf1b1d9a5ad87eb7eee052aad48a7d96ea3f\u0022, \u0022event_fingerprint\u0022: \u002265404c39b31ddfa5a491d4cbdf7539c4759cb4d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022c1a4e903b56c46d200d718ee3a83630a\u0022, \u0022path_pattern_hash\u0022: \u0022a2557b8d5a9637c813b7d4a0495197d3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229ef64d801ba8dd47add0832798d2b4cd797c2c4c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/docs\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/docs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":124},{"id":5030476,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48442,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":3,"waf_tags":"[\u0022950601:k8s-metrics\u0022]","http_method":"GET","http_target":"\/healthz","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022bc862a33cabbfc1a7e7c8c72fe1a9ca84be78240\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 127, \u0022payload_entropy\u0022: 5.05779704662052, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224f4781c67087b3f8b43419cb39d59a42b0781d6d\u0022, \u0022event_fingerprint\u0022: \u0022f76717067c8be28759be16f5101c7624b2e2025f\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0259\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/healthz\u0022], \u0022pattern_ids\u0022: [\u0022pat-0259\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022e162a0f135479492ec9edb36fae5cd69\u0022, \u0022path_pattern_hash\u0022: \u002215a99506b4e1757dce48edc0f607d4a4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/healthz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022], \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/healthz\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950601:k8s-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022k8s-metrics\u0022], \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fecc0ddc6c842c10efdad48a946ac0961c20c8b9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/healthz\u0022, \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/healthz\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: k8s-metrics \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/healthz\u0022, \u0022request_line\u0022: \u0022GET \/healthz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/healthz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/healthz HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950601:k8s-metrics\u0022, \u0022http_probe_healthz\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950601:k8s-metrics\u0022, \u0022http_probe_healthz\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":4,"bytes_in":127},{"id":5030475,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48422,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":14,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/v1\/models","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022b4dbc0e5f8d08267b3350ec2235f7776deb82823\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.108548582355166, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 52, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022418107cad8306cd23cbf426e69a08bae4fc0728a\u0022, \u0022event_fingerprint\u0022: \u0022a8073759f4ce8ef131ef273ebcdd10e09e1e5852\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d48adca5fbaae222e6a5f4f9e07e768f\u0022, \u0022path_pattern_hash\u0022: \u0022d7b0903584595062c9a8a7bf8cc51283\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 52}, \u0022payload_preview\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/v1\/models\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/v1\/models HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/v1\/models\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/v1\/models HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226de87ee2b51ab4de527e0a00b68c63ebc333b253\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/v1\/models\u0022, \u0022request_line\u0022: \u0022GET \/v1\/models HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/v1\/models\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 52, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/v1\/models\u0022, \u0022request_line\u0022: \u0022GET \/v1\/models HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/v1\/models\u0022, \u0022evidence_snippet\u0022: \u0022GET \/v1\/models HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950468:nosqli-3\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950468:nosqli-3\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":8,"bytes_in":129},{"id":5030474,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48410,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/queue","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00220f1d0987aba47e543bbe8d9c11819b3bd14b4995\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.0644461030651655, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022bf2f8094ed83eb68b08975496bd4a7611a78acc7\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022539ec24a2e508b0ce4b8f4e6390efad0\u0022, \u0022path_pattern_hash\u0022: \u00223d1cc4ce2f040f076d575f131bcf7395\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/queue\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/queue\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e97385a03a658d3b523d287cca9e984da934fd7d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/queue\u0022, \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/queue\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/queue\u0022, \u0022request_line\u0022: \u0022GET \/api\/queue HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/queue\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/queue HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":129},{"id":5030473,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48396,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/object_info","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00228cc2741f8bbc9ab7c7b589ec72d0133f7d96e86c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.086395791461033, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022c8a25ef0320c492ce919a54fbe604624b0f788c0\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002289678d5f212f3620d44b060cef082d5c\u0022, \u0022path_pattern_hash\u0022: \u00229e8f1a69932aa70c2350675be967ad67\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/object_info\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/object_info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/object_info\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/object_info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022354736a59cc4b748d4ce088517f2e0650274b19c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/object_info\u0022, \u0022request_line\u0022: \u0022GET \/api\/object_info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/object_info\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/object_info\u0022, \u0022request_line\u0022: \u0022GET \/api\/object_info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/object_info\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/object_info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":135},{"id":5030472,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48392,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/system_stats","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022d981879983216b8a82eb4e8fed1a4b3f3bd7b5ce\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 136, \u0022payload_entropy\u0022: 5.087647592435898, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022525228be21199785ca6b6b077705b9a5af279b60\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022abad0df6126e5839104e1aed946616be\u0022, \u0022path_pattern_hash\u0022: \u0022480a39357e539536b312ea4e6b47003e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system_stats\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system_stats\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022730fe8d05ebbdc8c905a6abbfeb2e2a38f5f0786\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system_stats\u0022, \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/system_stats\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system_stats\u0022, \u0022request_line\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/system_stats\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/system_stats HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":136},{"id":5030471,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48388,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/system-info","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022a671680a55b6a1ee94330de4520cfcc754a71808\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.093948013747358, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022aa64dcfdae60e8fd765c5201650740286fd0bf89\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00226c1dcd554b26b005e021b112b96402f2\u0022, \u0022path_pattern_hash\u0022: \u00225c28729995d98121cf999d531b267c4d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system-info\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system-info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/system-info\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/system-info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002298c06ab110f5c4cfd717dbbd42b48945f1cae988\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system-info\u0022, \u0022request_line\u0022: \u0022GET \/api\/system-info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/system-info\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/system-info\u0022, \u0022request_line\u0022: \u0022GET \/api\/system-info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/system-info\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/system-info HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":135},{"id":5030470,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48382,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/tags","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022cde412588e4eb9223c5fe3ed29cd50624af6b3d6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.039864825469013, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022b40c92a38573d8b5e4edb351b86be6c2a174ff79\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022ebb4321954dbe38816843323125d3039\u0022, \u0022path_pattern_hash\u0022: \u00220b9689ff0de7d3cfbe6f81aa48fb9f18\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/tags\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/tags HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/tags\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/tags HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aea3b9fbafa1c77979d8b36f26400856bfd0a135\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/tags\u0022, \u0022request_line\u0022: \u0022GET \/api\/tags HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/tags\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/tags\u0022, \u0022request_line\u0022: \u0022GET \/api\/tags HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/tags\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/tags HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":128},{"id":5030469,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48372,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/sessions","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u002202a7601544faeb2bf9fcee39094ae668e9ee4c63\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.030681416310094, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022499d1527fda11e4a53c09b15f254aed957809bd6\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022983383b92f57c365ae60ad6c04cea1c7\u0022, \u0022path_pattern_hash\u0022: \u0022e50fe3fb8c42fd2ed6f83b8ff39a27a1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sessions\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/sessions HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sessions\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/sessions HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002226252b31523cf1e000e7cfbb2f97bc0be3938ad1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sessions\u0022, \u0022request_line\u0022: \u0022GET \/api\/sessions HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sessions\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sessions\u0022, \u0022request_line\u0022: \u0022GET \/api\/sessions HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sessions\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/sessions HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":132},{"id":5030468,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48368,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/terminals","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00224c49064bb42c7ed170700b40b5c02c2c4e077e9b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.065757561181543, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022b7d10a7559c3b973453ee75015b47e7987cd2d58\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d76ea4dfba975d0c1aa8094d9dd50df0\u0022, \u0022path_pattern_hash\u0022: \u00228c8320d5f0b2d90f7ab21832d3aaaed1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/terminals\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/terminals\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002269884f2ef4913b8875cbf2c211e92d0d24ac318d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/terminals\u0022, \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/terminals\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/terminals\u0022, \u0022request_line\u0022: \u0022GET \/api\/terminals HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/terminals\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/terminals HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":133},{"id":5030467,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48356,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/status\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u002281f1b0251c318d313a78501bd7eecb760a0810d8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.03994244874773, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022da8dafd726bc0a4c234759a62d86eb0748599494\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022647d6bb2bd1e81fe48885b3587b97e32\u0022, \u0022path_pattern_hash\u0022: \u0022a7af473e86e8159e5549d1b5fb7ccbfe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/status\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/status\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228c95f6fe2e7f26c489456526ec2bf1676f48a9f4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/status\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/status\/\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/status\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/status\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/status\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":131},{"id":5030466,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48322,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/config\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022e2dbae58d04aa04ae6855ecd72c9cf7cd4385718\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.043684624287218, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u002233119b7017973db10e966c7975b1ad100b4bc58f\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022a6d0405042e3826fe40352effe25902f\u0022, \u0022path_pattern_hash\u0022: \u00223a8f94ca395d86dbc38cdcdf8db888dc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022956076581342a602c7df76aef9968fe56c68b841\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":131},{"id":5030465,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48340,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/status","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00227fbc29f027b400f6512972fd492109517e235ed4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 130, \u0022payload_entropy\u0022: 5.043553829293353, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u00225c772cb7a85da8d81766140d88a4d92c248f04fe\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00223aa5b958ba27cd6efcfd01535a7e167b\u0022, \u0022path_pattern_hash\u0022: \u00220ea44bf547cfd3e93a42dabfc2f1808a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/status\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/status HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/status\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/status HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002267dca3559a2b7114f380cedc4cccb4b0cebb259a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/status\u0022, \u0022request_line\u0022: \u0022GET \/api\/status HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/status\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/status\u0022, \u0022request_line\u0022: \u0022GET \/api\/status HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/status\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/status HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":130},{"id":5030464,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48380,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/spec","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022f090885f278abd608c17d2a40cb2b392dffcf756\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.030464290173152, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u002206238b2ca2163be09028e9c9ced75f2da38166a6\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002244bd452f97f020db9fcba5d4fdd2e6b1\u0022, \u0022path_pattern_hash\u0022: \u002233132cb5c4063b31464a0c7ba122eb34\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/spec\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/spec\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227aeedd26b63b1f8fb5d36ed85c1256b6503d1468\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/spec\u0022, \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/spec\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/spec\u0022, \u0022request_line\u0022: \u0022GET \/api\/spec HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/spec\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/spec HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":128},{"id":5030463,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48362,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/kernels","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u002245d530a5cb4421de00a6f61b726eb063e6d9ada5\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.065562003932515, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022f2911f09ecaf1fc3394d95e41593a020f12a522a\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00223f8de3da341df3bbe90ee07225eddbbb\u0022, \u0022path_pattern_hash\u0022: \u00225453b26356ce90e73655c3611a048b98\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/kernels\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/kernels HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/kernels\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/kernels HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225592f006d4cbf14f1864f098bc133ce0af3829a7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/kernels\u0022, \u0022request_line\u0022: \u0022GET \/api\/kernels HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/kernels\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/kernels\u0022, \u0022request_line\u0022: \u0022GET \/api\/kernels HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/kernels\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/kernels HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":131},{"id":5030462,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48338,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022550c2ec4c29c432f9a6bf5d6f73f786994cf6c15\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 131, \u0022payload_entropy\u0022: 5.065407148084143, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u00222e046f030e9bb898e3376686e9ad1edf121c2b02\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u002272292070bb130df640516f7928c2df32\u0022, \u0022path_pattern_hash\u0022: \u00225694bd8f8cc07635f19710e0b27b1995\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/version\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/version\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ca02447029cc8b89dba5fa7d346c1fb1ad90c371\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/version\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/version HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":131},{"id":5030461,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48316,"dst_port":3001,"service":"http","classification":"config_file_probe","waf_score":18,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/contents\/.env","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u002243606b81662e6dc782c93327214d5418b5eb1843\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 137, \u0022payload_entropy\u0022: 5.018025737975589, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 80.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 80.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002256e8455b3d108a4c84582c97e6a5dba439d0a308\u0022, \u0022event_fingerprint\u0022: \u00220be6f41035b0450ef868615ec7f206201c5be391\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 215, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 80.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00227e66d8da855d0e380e277b6fdd8b91cc\u0022, \u0022path_pattern_hash\u0022: \u0022e15548c37c11e63ada1572b6dac3bbfa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/.env\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221b1a875b1b82164042621173f6592c15a4bb6613\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/.env\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/.env\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 80.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/.env\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 80 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":9,"bytes_in":137},{"id":5030460,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48298,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/contents\/root","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00222907717c06bc3f0f6fc40917bf53a046aba95526\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 137, \u0022payload_entropy\u0022: 5.005537631494949, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u00229194388fdaa7d046fe5c2a9751828e211cd9fc2d\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d547015e10c0180b51fc2006d4909ae2\u0022, \u0022path_pattern_hash\u0022: \u00221f6f31fa880f7622c340c20c5d894e8b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/root\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/root\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002224b3fe417ba54444dcf571a86d2a0e7cae818dc3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/root\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/root\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/root\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/root\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/root HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":137},{"id":5030459,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48310,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/contents\/root\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u002200f1848363ff63d5fcb95b79a51bf71cef14f537\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 138, \u0022payload_entropy\u0022: 5.001180621264688, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022d12f79f577948dd04fa267c4a83521b5853b46b5\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022d6f503edadc11cb0575e5f81e4ef230e\u0022, \u0022path_pattern_hash\u0022: \u0022603fd1723d44aea6e79bc54c0c1e5488\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/root\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/root\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002223ab775b17ac35ed287f50fef6fab960ebd01655\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/root\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/root\/\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/root\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/root\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/root\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.3\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":138},{"id":5030423,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48272,"dst_port":3001,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.example","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022example\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022080963ef62d711207d0e68706f04d0705ec4d7fa\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 132, \u0022payload_entropy\u0022: 5.071417536833784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220a2f319a768d3d4a18dc00cc3be5c2a23ec0ce5a\u0022, \u0022event_fingerprint\u0022: \u0022c8ca3b6029fded4b8cb6bdd42a7d8814546e2cb5\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022eb4a0b9c017c7d98fc88866545baeac5\u0022, \u0022path_pattern_hash\u0022: \u0022f8bf22cb3ab23601599be7f21fa00aee\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.example\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.example\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224aedff6c28e878dfe70c9b548b0ef58a5788578a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.example\u0022, \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.example\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.example\u0022, \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.example\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":132},{"id":5030422,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48260,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/.runpod\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022runpod\u0022, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u00224e3d1331e348a58c5b5774d2a24ca29aa3864ac1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 128, \u0022payload_entropy\u0022: 5.058157328518201, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224ca8bf0f361dc0c619a54a80a505ded1243bece6\u0022, \u0022event_fingerprint\u0022: \u00223740d79ec46f08327eec31008d3f4227da87f377\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u0022cb64a927f8f0ff358170c1f2ddea242f\u0022, \u0022path_pattern_hash\u0022: \u0022ae4db99db3288403932aaddfb1b3f2a8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.runpod\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.runpod\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b3d6baec49229fab965e087f8cfe5909f7ec8bcf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.runpod\/\u0022, \u0022request_line\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.runpod\/\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.runpod\/\u0022, \u0022request_line\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.runpod\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.runpod\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":7,"bytes_in":128},{"id":5030421,"ip":"170.9.255.3","ts":"2026-10-20 01:06:57.000000","proto":"tcp","src_port":48276,"dst_port":3001,"service":"http","classification":"http_flood","waf_score":10,"waf_tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/contents\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d\u0022, \u0022emulator_response_len\u0022: 107, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002272cd8c2bff9aefc99b70d8e7774b74c0c85e1524\u0022, \u0022http_host_hash\u0022: \u002268964bd149320edbceb0d6a222e6bc3e0bdb74e3\u0022, \u0022http_target_hash\u0022: \u0022795de351af210264615d35beed0e5271aba12375\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 133, \u0022payload_entropy\u0022: 5.011088808949967, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3001, \u0022risk_waf\u0022: 48.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022487ba21c2c35344bf313a808259a55f18e2691fb\u0022, \u0022event_fingerprint\u0022: \u0022088a3e0b2b2c7fc4598dfca31d6888badc47eb63\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ae917b654ef4f95bac2c2f7f69dc5141\u0022, \u0022payload_hash\u0022: \u00223bd9111bfbeed638b4ab596065989393\u0022, \u0022path_pattern_hash\u0022: \u0022f9c77d5b847ab2c5e797561415cef2db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/contents\/\u0022, \u0022user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:3001\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022adce40c0fa9029c5de41004c487e3782d4a9024d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3, k8s-api \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 48.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/contents\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022WebSiphon\/next-0.1\u0022, \u0022port\u0022: 3001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:3001 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/contents\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/contents\/ HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: WebSiphon\/next-0.1\\r\\naccept-encoding: gzip,deflate,br\\r\\nhost: 62.3.50.33:300\u0022, \u0022target_port_label\u0022: \u00223001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022grafana\u0022, \u0022http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3001","http_user_agent":"WebSiphon\/next-0.1","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_flood\u0022]","anomalies":"[]","severity":5,"bytes_in":133}],"total_events":604}