18.225.112.125

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.803732780855846,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 8079,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5037dcb553981db413b8f9c6e139399444b5d091",
    "event_fingerprint": "063f9bba48c35ddab6f31fcdd07772c407b5ae0d",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "58e5f7f0a155eb10421be3267556134a",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8079,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\ufffd4\u001d\ufffdT2p\ufffd\ufffd\ufffd\u0017\ufffd\ufffd@\ufffdu\u0014\ufffd\ufffd\bRue\u0007\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\u001e\ufffd\u0000\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\ufffd4\u001d\ufffdT2p\ufffd\ufffd\ufffd\u0017\ufffd\ufffd@\ufffdu\u0014\ufffd\ufffd\bRue\u0007\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\u001e\ufffd\u0000\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0011\ufffd\u001f*1\ufffd\ufffd \ufffdU\ufffdH7\ufffd\ufffd\ufffdW\ufffd,\ufffd_\ufffd\u0005~\u0490\ufffdQ\u0003\u0004\ufffdx",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\ufffd4\u001d\ufffdT2p\ufffd\ufffd\ufffd\u0017\ufffd\ufffd@\ufffdu\u0014\ufffd\ufffd\bRue\u0007\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\u001e\ufffd\u0000\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e8dcc786186ed836f08cd9da8b3ff2de1fe1bd8b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\ufffd4\u001d\ufffdT2p\ufffd\ufffd\ufffd\u0017\ufffd\ufffd@\ufffdu\u0014\ufffd\ufffd\bRue\u0007\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\u001e\ufffd\u0000\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8079,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd2\ufffd\ufffd4\ufffdT2p\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffdu\ufffd\ufffdRue\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\ufffd\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:8079 \u00b7 (sonde \/ probe)",
    "target_port_label": "8079 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8079,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\ufffd4\u001d\ufffdT2p\ufffd\ufffd\ufffd\u0017\ufffd\ufffd@\ufffdu\u0014\ufffd\ufffd\bRue\u0007\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\u001e\ufffd\u0000\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8079,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8079 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd2\ufffd\ufffd4\ufffdT2p\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffdu\ufffd\ufffdRue\ufffd\ufffd\"\ufffd \ufffd6\ufffd\ufffd:J\ufffd\ufffd\ufffd_\ufffd\ufffdp\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\u03c7\ufffdP+A\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "8079 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8079"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 261,
    "payload_entropy": 5.862991594264662,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 8079,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5037dcb553981db413b8f9c6e139399444b5d091",
    "event_fingerprint": "c15f74116802f679b214cab38c14483e34268c3e",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "payload_hash": "23d810147a2fec81e84a673df8de67e5",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 8079,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003lT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffd\u0006G\ufffd[\u001e\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffd\u000bo\ufffdpX\u0015\u06d5\u0019r\ufffd\ufffd\ufffd\u0006\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\u0005\\\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003lT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffd\u0006G\ufffd[\u001e\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffd\u000bo\ufffdpX\u0015\u06d5\u0019r\ufffd\ufffd\ufffd\u0006\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\u0005\\\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 1{\u001e\ufffd\ufffd&\ufffd\u0006\ufffd\u0b90\ufffd\ufffd\ufffd\ufffdZ\ufffd7\ufffdp\ufffd\ufffdg\ufffd\u0004\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003lT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffd\u0006G\ufffd[\u001e\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffd\u000bo\ufffdpX\u0015\u06d5\u0019r\ufffd\ufffd\ufffd\u0006\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\u0005\\\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "24ab681a2c14783b3255826af9daeee6221d42cf",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003lT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffd\u0006G\ufffd[\u001e\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffd\u000bo\ufffdpX\u0015\u06d5\u0019r\ufffd\ufffd\ufffd\u0006\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\u0005\\\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "port": 8079,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffdlT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffdG\ufffd[\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffdo\ufffdpX\u06d5r\ufffd\ufffd\ufffd\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\\&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:8079 \u00b7 (sonde \/ probe)",
    "target_port_label": "8079 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8079,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003lT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffd\u0006G\ufffd[\u001e\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffd\u000bo\ufffdpX\u0015\u06d5\u0019r\ufffd\ufffd\ufffd\u0006\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\u0005\\\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
            "port": 8079,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8079 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdlT\ufffd\ufffdrUvo\ufffd\ufffd\ufffdX\ufffd\ufffdG\ufffd[\ufffd\ufffd~ \ufffdJ:\ufffd{\ufffd\ufffd \ufffd\u06cd\ufffdo\ufffdpX\u06d5r\ufffd\ufffd\ufffd\u0728\ufffd|R\ufffd\ufffd8\ufffd\ufffdS\ufffd\\&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "8079 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8079"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "f64886564551b41dbc330963b278bf0e65e65c51",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.298539516253352,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 8079,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1d63ae5fdb4ea033d5c4b758be23a33264c3aad4",
    "event_fingerprint": "d7b178411021c8200d6979c3104a4c5f99731a9e",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "507803526887e281bd1b28bea0970515",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8079,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "97b792120343f35e2fe684150bc7099b0dc30749",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 8079,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:8079 \u00b7 (tentative d'exploit)",
    "target_port_label": "8079 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8079,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 8079,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:8079 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "8079 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8079"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "f64886564551b41dbc330963b278bf0e65e65c51",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.298539516253352,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 8079,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1d63ae5fdb4ea033d5c4b758be23a33264c3aad4",
    "event_fingerprint": "d7b178411021c8200d6979c3104a4c5f99731a9e",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "507803526887e281bd1b28bea0970515",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8079,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "97b792120343f35e2fe684150bc7099b0dc30749",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 8079,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:8079 \u00b7 (tentative d'exploit)",
    "target_port_label": "8079 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8079,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 8079,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:8079 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8079\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "8079 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8079"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.873879972999071,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 9043,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "54888f9b2f1d90fdc92161195a3f969bce931fc0",
    "event_fingerprint": "0c5445bc9ce700222d77bf0d23aac28c88d51725",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "71ffa9ba6ef10170e84ec20e9752c1c7",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9043,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ix\b\u0011\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6\u001cZs\ufffd\u0018\ufffd8\ufffd\ufffd\u0750\ufffd\b\u001d\ufffde \ufffd;\ufffd\ufffd\u0005\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\u0015\ufffd1\ufffd9e~\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ix\b\u0011\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6\u001cZs\ufffd\u0018\ufffd8\ufffd\ufffd\u0750\ufffd\b\u001d\ufffde \ufffd;\ufffd\ufffd\u0005\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\u0015\ufffd1\ufffd9e~\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 q\ufffdx\ufffdo\ufffdhH\u001b\r\/\ufffdE\ufffd\ufffd$\ufffd\"\ufffd+b\ufffd\ufffd\ufffdv\u0088\ufffd\ufffdp",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ix\b\u0011\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6\u001cZs\ufffd\u0018\ufffd8\ufffd\ufffd\u0750\ufffd\b\u001d\ufffde \ufffd;\ufffd\ufffd\u0005\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\u0015\ufffd1\ufffd9e~\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "28b8b521afeafa66a0a7c80dc202444795f15e48",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ix\b\u0011\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6\u001cZs\ufffd\u0018\ufffd8\ufffd\ufffd\u0750\ufffd\b\u001d\ufffde \ufffd;\ufffd\ufffd\u0005\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\u0015\ufffd1\ufffd9e~\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9043,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdIx\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6Zs\ufffd\ufffd8\ufffd\ufffd\u0750\ufffd\ufffde \ufffd;\ufffd\ufffd\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd1\ufffd9e~&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:9043 \u00b7 (sonde \/ probe)",
    "target_port_label": "9043 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 9043,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ix\b\u0011\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6\u001cZs\ufffd\u0018\ufffd8\ufffd\ufffd\u0750\ufffd\b\u001d\ufffde \ufffd;\ufffd\ufffd\u0005\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\u0015\ufffd1\ufffd9e~\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9043,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:9043 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdIx\ufffdD4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6Zs\ufffd\ufffd8\ufffd\ufffd\u0750\ufffd\ufffde \ufffd;\ufffd\ufffd\t\ufffda\u076b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd1\ufffd9e~&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "9043 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "9043"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:9020",
        "port:9043",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.804715804079694,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 9020,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "073ec9985d6e0fd552f301219e1a1c2ca1bb3670",
    "event_fingerprint": "a142133cd1fa9e598077997bf4c6f1dde0fd7da5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "05ebb17b935bf0ddedec4140640b34cd",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9020,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005\u001d\ufffd\u0004\ufffd\ufffd\ufffd1\ufffd\u04a9\u001b!.\ufffdHGe\ufffd\ufffd(\u0011Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \u0006\ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\f\ufffd\u0015zr\/#\ufffdH\u0003^\ufffd\ufffdDM\u0007\ufffdH\ufffd)\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005\u001d\ufffd\u0004\ufffd\ufffd\ufffd1\ufffd\u04a9\u001b!.\ufffdHGe\ufffd\ufffd(\u0011Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \u0006\ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\f\ufffd\u0015zr\/#\ufffdH\u0003^\ufffd\ufffdDM\u0007\ufffdH\ufffd)\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd?\ufffd\ufffd\ufffdR\u0016\ufffd\ufffd^\u0018\ufffd\ufffds2\u0007k\ufffd\ufffd\ufffd\/\ufffd[@*\ufffd\ufffdd#\u0014\ufffdd",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005\u001d\ufffd\u0004\ufffd\ufffd\ufffd1\ufffd\u04a9\u001b!.\ufffdHGe\ufffd\ufffd(\u0011Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \u0006\ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\f\ufffd\u0015zr\/#\ufffdH\u0003^\ufffd\ufffdDM\u0007\ufffdH\ufffd)\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "348ce9b47ec55f3820930c6a3c048e19cab5d6c7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005\u001d\ufffd\u0004\ufffd\ufffd\ufffd1\ufffd\u04a9\u001b!.\ufffdHGe\ufffd\ufffd(\u0011Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \u0006\ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\f\ufffd\u0015zr\/#\ufffdH\u0003^\ufffd\ufffdDM\u0007\ufffdH\ufffd)\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 9020,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\u04a9!.\ufffdHGe\ufffd\ufffd(Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\ufffdzr\/#\ufffdH^\ufffd\ufffdDM\ufffdH\ufffd)&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:9020 \u00b7 (sonde \/ probe)",
    "target_port_label": "9020 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 9020,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005\u001d\ufffd\u0004\ufffd\ufffd\ufffd1\ufffd\u04a9\u001b!.\ufffdHGe\ufffd\ufffd(\u0011Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \u0006\ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\f\ufffd\u0015zr\/#\ufffdH\u0003^\ufffd\ufffdDM\u0007\ufffdH\ufffd)\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 9020,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:9020 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\u04a9!.\ufffdHGe\ufffd\ufffd(Mu\ufffd\u01a2\ufffd\ufffdc\ufffdr \ufffdw\ufffd\ufffd\ufffd\u0789\ufffdk=f\ufffdzr\/#\ufffdH^\ufffd\ufffdDM\ufffdH\ufffd)&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "9020 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "9020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:9020",
        "port:9043",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": null,
    "app_proto": null,
    "asn": 16509,
    "country": "US",
    "dst_port": 9043,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4fde80cd5057e508e8e6750e2b24ab283da76472",
    "event_fingerprint": "96e7c281a39d42a0bcc741e77811aaaab2487db5",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9043,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b291571ea98da1f60e14d136d6be5a8e9a5a8773",
    "protocol_details": {
        "port": 9043
    },
    "attack_vector": "Sonde port \u00b7 port 9043 \u00b7 (sonde \/ probe)",
    "target_port_label": "9043",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9043,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 9043
        },
        "attack_vector": "Sonde port \u00b7 port 9043 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9043",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9043"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9020",
        "port:9043"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": null,
    "app_proto": null,
    "asn": 16509,
    "country": "US",
    "dst_port": 9020,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4a0b8add0c30ee38ec7d2d6a677ca523d4d073c4",
    "event_fingerprint": "3f02bd4057435411a05ce4a9b699e2dae795d4e7",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9020,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d1b6e283b884965ed986b19a312c073b8cab89f",
    "protocol_details": {
        "port": 9020
    },
    "attack_vector": "Sonde port \u00b7 port 9020 \u00b7 (sonde \/ probe)",
    "target_port_label": "9020",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9020,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 9020
        },
        "attack_vector": "Sonde port \u00b7 port 9020 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9020",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9020",
        "port:9043"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "90eaf61b8da1d16bf3de0d42e105776258f54afc",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.292543458516563,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 9043,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "918a82697ff87d8c2eca8a4072a5e452222bb808",
    "event_fingerprint": "345a1e39496900c93f050e64a111676bb139b428",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.7,
    "classification_confidence": 0.7,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 52,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "de11ae15d1142f0b05a943313f24f6ae",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9043,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "90b1534470776485ff8bdcd7153cf7c91332d793",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 9043,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:9043 \u00b7 (tentative d'exploit)",
    "target_port_label": "9043 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 70,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 52,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9043,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 9043,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:9043 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "9043 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9043"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9043"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": null,
    "app_proto": null,
    "asn": 16509,
    "country": "US",
    "dst_port": 9043,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4fde80cd5057e508e8e6750e2b24ab283da76472",
    "event_fingerprint": "96e7c281a39d42a0bcc741e77811aaaab2487db5",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9043,
        "risk_score": 33
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5363caf0a124ea57c8729420a2e3dfb2a53b3dd5",
    "protocol_details": {
        "port": 9043
    },
    "attack_vector": "Sonde port \u00b7 port 9043 \u00b7 (sonde \/ probe)",
    "target_port_label": "9043",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9043,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 9043
        },
        "attack_vector": "Sonde port \u00b7 port 9043 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9043",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9043"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9043"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "2da122f49153a2ee4b1f9f80eb432d6bf47f0047",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.275772419155986,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 9020,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d6c7bda0200e559023fde36a9202f16624222ae6",
    "event_fingerprint": "e10daf98c008597e00b7ef26b406b9503e387be5",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 53
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "0d43aa63d43948f0afc0904be862603a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9020,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3b24e0e67f86a611f5793231257308771b77cf0e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 9020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:9020 \u00b7 (tentative d'exploit)",
    "target_port_label": "9020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 53
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9020,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 9020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:9020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "9020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "90eaf61b8da1d16bf3de0d42e105776258f54afc",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.292543458516563,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 9043,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "918a82697ff87d8c2eca8a4072a5e452222bb808",
    "event_fingerprint": "345a1e39496900c93f050e64a111676bb139b428",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "de11ae15d1142f0b05a943313f24f6ae",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9043,
        "service": "http",
        "service_name": "http",
        "risk_score": 52
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "90b1534470776485ff8bdcd7153cf7c91332d793",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 9043,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:9043 \u00b7 (tentative d'exploit)",
    "target_port_label": "9043 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9043,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 9043,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:9043 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9043\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "9043 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9043"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "2da122f49153a2ee4b1f9f80eb432d6bf47f0047",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.275772419155986,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 9020,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 53,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d6c7bda0200e559023fde36a9202f16624222ae6",
    "event_fingerprint": "e10daf98c008597e00b7ef26b406b9503e387be5",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 53
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "0d43aa63d43948f0afc0904be862603a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9020,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3b24e0e67f86a611f5793231257308771b77cf0e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 9020,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:9020 \u00b7 (tentative d'exploit)",
    "target_port_label": "9020 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 53
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9020,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 9020,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:9020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9020\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "9020 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.802024599052324,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 162,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ea58424a3bd5885fabdc250a4ea9ab6b9681f91d",
    "event_fingerprint": "0baf9a4fa6586aa998e041f57d9bbae1906e8a7d",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "d7493dc73045a29c941f36f54f2c5a9c",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 162,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06b2\u0006\ufffd\ufffd\ufffd\ufffd|]t\ufffd\u000bu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd\u0013<\ufffd \ufffd\u0016 uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdn .\ufffd\ufffd\t=\b\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06b2\u0006\ufffd\ufffd\ufffd\ufffd|]t\ufffd\u000bu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd\u0013<\ufffd \ufffd\u0016 uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdn .\ufffd\ufffd\t=\b\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \t-}\ufffd]\ufffdjF@^b\u0007\ufffdv6\ufffds\u001b\\\u0004\ufffd\ufffd>Q\u0018\ufffdIs\ufffd \ufffd ",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06b2\u0006\ufffd\ufffd\ufffd\ufffd|]t\ufffd\u000bu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd\u0013<\ufffd \ufffd\u0016 uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdn .\ufffd\ufffd\t=\b\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f01faf76956d036a443e58097793dbf969563b74",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06b2\u0006\ufffd\ufffd\ufffd\ufffd|]t\ufffd\u000bu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd\u0013<\ufffd \ufffd\u0016 uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdn .\ufffd\ufffd\t=\b\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 162,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\u06b2\ufffd\ufffd\ufffd\ufffd|]t\ufffdu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd<\ufffd \ufffd uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn .\ufffd\ufffd\t=\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:162 \u00b7 (sonde \/ probe)",
    "target_port_label": "162 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 162,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06b2\u0006\ufffd\ufffd\ufffd\ufffd|]t\ufffd\u000bu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd\u0013<\ufffd \ufffd\u0016 uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdn .\ufffd\ufffd\t=\b\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 162,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:162 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u06b2\ufffd\ufffd\ufffd\ufffd|]t\ufffdu\ufffd\u052aN\ufffd\ufffdn\ufffd\ufffdu\u0623\ufffd<\ufffd \ufffd uHg\ufffdj0m\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn .\ufffd\ufffd\t=\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd'&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "162 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "162"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 261,
    "payload_entropy": 5.846773424476363,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 162,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ea58424a3bd5885fabdc250a4ea9ab6b9681f91d",
    "event_fingerprint": "1aaf29824c09816c2c4984f13edd7d317a27af39",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "payload_hash": "7ce9a5c4e4997baf05c8b83af866ec62",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 162,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001eE\ufffd\u000b\ufffd\ufffd8\u7c53\bp\ufffd\ufffdWC\u0010h\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\u0010\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=\u0000y\ufffd)\ufffd\b\r)\u0002\ufffd3\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001eE\ufffd\u000b\ufffd\ufffd8\u7c53\bp\ufffd\ufffdWC\u0010h\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\u0010\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=\u0000y\ufffd)\ufffd\b\r)\u0002\ufffd3\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0000\ufffd\u0018\ufffd\ufffd!E\ufffd\u001b\ufffd\ufffd[\\\ufffd\u0006A\ufffd,\ufffdJ\ufffd\ufffd\ufffd]\ufffdj",
        "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001eE\ufffd\u000b\ufffd\ufffd8\u7c53\bp\ufffd\ufffdWC\u0010h\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\u0010\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=\u0000y\ufffd)\ufffd\b\r)\u0002\ufffd3\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a03f2a18208d025f9e413773f547385fa838692",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001eE\ufffd\u000b\ufffd\ufffd8\u7c53\bp\ufffd\ufffdWC\u0010h\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\u0010\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=\u0000y\ufffd)\ufffd\b\r)\u0002\ufffd3\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "port": 162,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdE\ufffd\ufffd\ufffd8\u7c53p\ufffd\ufffdWCh\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=y\ufffd)\ufffd\r)\ufffd3&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:162 \u00b7 (sonde \/ probe)",
    "target_port_label": "162 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 162,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001eE\ufffd\u000b\ufffd\ufffd8\u7c53\bp\ufffd\ufffdWC\u0010h\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\u0010\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=\u0000y\ufffd)\ufffd\b\r)\u0002\ufffd3\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
            "port": 162,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:162 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdE\ufffd\ufffd\ufffd8\u7c53p\ufffd\ufffdWCh\ufffd\ufffdf\u0116\ufffd\u01e1B\ufffd4\ufffd U\ufffdGj\ufffd\ufffd9\ufffdd\ufffd\ufffd\ufffd\ufffdu\ufffdpd\u038a=y\ufffd)\ufffd\r)\ufffd3&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "162 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "162"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "b90b29deb1dd36cdfe8358eb6fb70475ccb6b98d",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 190,
    "payload_entropy": 5.263164049762067,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 162,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 50,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "aead152cbf7b623db29e7a11765fb23f8c153fcb",
    "event_fingerprint": "0561f90e8fb47a15f1b886051ba3c76a34af09af",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "f6ce9952e00bf0e7abea54bc78380066",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 162,
        "service": "http",
        "service_name": "http",
        "risk_score": 50
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d1d0de329dd26b2a53ce41c092d0d9bd7c038693",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 162,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "attack_vector": "exploit attempt \u00b7 via HTTP:162 \u00b7 (tentative d'exploit)",
    "target_port_label": "162 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 50
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 162,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 162,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:162 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "target_port_label": "162 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "162"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "b90b29deb1dd36cdfe8358eb6fb70475ccb6b98d",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 190,
    "payload_entropy": 5.263164049762067,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 162,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 50,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "aead152cbf7b623db29e7a11765fb23f8c153fcb",
    "event_fingerprint": "0561f90e8fb47a15f1b886051ba3c76a34af09af",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "f6ce9952e00bf0e7abea54bc78380066",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 162,
        "service": "http",
        "service_name": "http",
        "risk_score": 50
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d1d0de329dd26b2a53ce41c092d0d9bd7c038693",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 162,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "attack_vector": "exploit attempt \u00b7 via HTTP:162 \u00b7 (tentative d'exploit)",
    "target_port_label": "162 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 50
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 162,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 162,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:162 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:162\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "target_port_label": "162 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "162"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "300c02010161070a010004000400",
    "emulator_response_len": 14,
    "bytes_in": 243,
    "payload_entropy": 5.8347450964380565,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "ldap",
    "app_proto": "ldap",
    "asn": 16509,
    "country": "US",
    "dst_port": 389,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "46616cb6e907ff0282ad3145a516fd96d127934f",
    "event_fingerprint": "e2ae41afc8a35e69ecf9bb72012d15ecccc001d6",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "ldap",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2399575dd2eba71dad31f7f04181b9fe",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 389,
        "service": "ldap",
        "service_name": "ldap",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003DC\u0018\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\u0006\u0005\ufffdm\u001fT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0010\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003DC\u0018\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\u0006\u0005\ufffdm\u001fT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0010\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 xT \ufffd8}\\w]\ufffd)\ufffdF7\u0498T\u56ea\ufffd)\ufffd\u001e\ufffd\ufffd\ufffd<",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003DC\u0018\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\u0006\u0005\ufffdm\u001fT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0010\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d7fb24449ff7224bc60a78b476be5edafb382d4d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003DC\u0018\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\u0006\u0005\ufffdm\u001fT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0010\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 389,
        "service": "ldap",
        "service_label_fr": "LDAP"
    },
    "evidence_snippet": "\ufffd\ufffdDC\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\ufffdmT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
    "target_port_label": "389 \u00b7 LDAP",
    "emulator_service": "ldap",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via LDAP",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "ldap",
        "service_label_fr": "LDAP",
        "dst_port": 389,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ldap",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003DC\u0018\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\u0006\u0005\ufffdm\u001fT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0010\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 389,
            "service": "ldap",
            "service_label_fr": "LDAP"
        },
        "attack_vector": "postgres probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdDC\ufffd\ufffd\ufffd\ufffd\ufffd-\r\ufffd\ufffd\ufffd<Qr\ufffd\ufffd8\ufffdmT\ufffd|x\ufffd \ufffd l\ufffd+\ufffd^3aU\ufffd\ufffd\t\ufffd\ufffd}\ufffd\ufffd\ufffdj\u0249\ufffd;{:\ufffd\ufffdO\ufffd\ufffd0&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "389 \u00b7 LDAP",
        "emulator_service": "ldap",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ldap",
        "service_banner": "honeypot-ldap",
        "service_os": "linux",
        "dst_port": "389"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "ldap_emulated",
        "net_ldap_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "300c02010161070a010004000400",
    "emulator_response_len": 14,
    "bytes_in": 261,
    "payload_entropy": 5.963078904522291,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "ldap",
    "app_proto": "ldap",
    "asn": 16509,
    "country": "US",
    "dst_port": 389,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "46616cb6e907ff0282ad3145a516fd96d127934f",
    "event_fingerprint": "e2ae41afc8a35e69ecf9bb72012d15ecccc001d6",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "ldap",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a23850afe8df1a72266e1d2004d94c96",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 389,
        "service": "ldap",
        "service_name": "ldap",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u00036\ufffdo\u001f9d\bDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\u0019\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u00036\ufffdo\u001f9d\bDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\u0019\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd0\ufffd\ufffd\ufffd\u001a@\u000b\ufffdz.!\ufffd\ufffd\ufffd\ufffd\u00136>\u0006F\ufffdYt\ufffdB",
        "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u00036\ufffdo\u001f9d\bDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\u0019\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c04c1b27f34ec1f1cd43e8de1e5ff04b2d426fd9",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u00036\ufffdo\u001f9d\bDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\u0019\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 389,
        "service": "ldap",
        "service_label_fr": "LDAP"
    },
    "evidence_snippet": "\ufffd6\ufffdo9dDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
    "target_port_label": "389 \u00b7 LDAP",
    "emulator_service": "ldap",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via LDAP",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "ldap",
        "service_label_fr": "LDAP",
        "dst_port": 389,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ldap",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u00036\ufffdo\u001f9d\bDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\u0019\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 389,
            "service": "ldap",
            "service_label_fr": "LDAP"
        },
        "attack_vector": "postgres probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd6\ufffdo9dDN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0657u4y\ufffd\ufffd\ufffdk\ufffd4\ufffd\ufffdV n`n\ufffd\ufffdB\ufffd\ufffd\ufffd}\n\ufffd\ufffd:\ufffdT'\ufffd\ufffd\/\ufffd.\ufffdz\ufffds*\ufffdV\ufffdG\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "389 \u00b7 LDAP",
        "emulator_service": "ldap",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ldap",
        "service_banner": "honeypot-ldap",
        "service_os": "linux",
        "dst_port": "389"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "ldap_emulated",
        "net_ldap_probe",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "300c02010161070a010004000400",
    "emulator_response_len": 14,
    "bytes_in": 190,
    "payload_entropy": 5.294742997130487,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "ldap",
    "app_proto": "ldap",
    "asn": 16509,
    "country": "US",
    "dst_port": 389,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15
    },
    "risk_score": 36,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "176a24200d9e6061c26a305428b17c94a2c00b77",
    "event_fingerprint": "e2ae41afc8a35e69ecf9bb72012d15ecccc001d6",
    "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15,
        "risk_score": 36
    },
    "named_classification_skipped": false,
    "service_name": "ldap",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bcd9c046ebe1e2cb36c7e3dbc2c5faf6",
        "path_pattern_hash": "79ba87c92cce1f6abf5b6560fb8afdba"
    },
    "target_context": {
        "dst_port": 389,
        "service": "ldap",
        "service_name": "ldap",
        "risk_score": 36
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "14b56ebe0569b86f1dd5a18ade01dd5c941ef5a2",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "port": 389,
        "service": "ldap",
        "service_label_fr": "LDAP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
    "target_port_label": "389 \u00b7 LDAP",
    "emulator_service": "ldap",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0007 \u2014 via LDAP",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 15,
            "risk_score": 36
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 36,
        "risk_label": "Faible",
        "service_name": "ldap",
        "service_label_fr": "LDAP",
        "dst_port": 389,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ldap",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
            "port": 389,
            "service": "ldap",
            "service_label_fr": "LDAP"
        },
        "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "target_port_label": "389 \u00b7 LDAP",
        "emulator_service": "ldap",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ldap",
        "service_banner": "honeypot-ldap",
        "service_os": "linux",
        "dst_port": "389"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "ldap_emulated",
        "mozi_pattern",
        "net_ldap_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "300c02010161070a010004000400",
    "emulator_response_len": 14,
    "bytes_in": 190,
    "payload_entropy": 5.294742997130487,
    "port_category": "well_known",
    "org": "Amazon.com, Inc.",
    "service": "ldap",
    "app_proto": "ldap",
    "asn": 16509,
    "country": "US",
    "dst_port": 389,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15
    },
    "risk_score": 36,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "176a24200d9e6061c26a305428b17c94a2c00b77",
    "event_fingerprint": "e2ae41afc8a35e69ecf9bb72012d15ecccc001d6",
    "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15,
        "risk_score": 36
    },
    "named_classification_skipped": false,
    "service_name": "ldap",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bcd9c046ebe1e2cb36c7e3dbc2c5faf6",
        "path_pattern_hash": "79ba87c92cce1f6abf5b6560fb8afdba"
    },
    "target_context": {
        "dst_port": 389,
        "service": "ldap",
        "service_name": "ldap",
        "risk_score": 36
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "14b56ebe0569b86f1dd5a18ade01dd5c941ef5a2",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "port": 389,
        "service": "ldap",
        "service_label_fr": "LDAP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
    "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
    "target_port_label": "389 \u00b7 LDAP",
    "emulator_service": "ldap",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0007 \u2014 via LDAP",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 15,
            "risk_score": 36
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 36,
        "risk_label": "Faible",
        "service_name": "ldap",
        "service_label_fr": "LDAP",
        "dst_port": 389,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ldap",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
            "port": 389,
            "service": "ldap",
            "service_label_fr": "LDAP"
        },
        "attack_vector": "ldap probe \u00b7 via LDAP:389 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:389\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
        "target_port_label": "389 \u00b7 LDAP",
        "emulator_service": "ldap",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ldap",
        "service_banner": "honeypot-ldap",
        "service_os": "linux",
        "dst_port": "389"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "ldap_emulated",
        "mozi_pattern",
        "net_ldap_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 243,
    "payload_entropy": 5.871040648160008,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http-alt-8008",
    "app_proto": "http-alt-8008",
    "asn": 16509,
    "country": "US",
    "dst_port": 8008,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "44b3f35faafd3524969073747a88a84f8d636a96",
    "event_fingerprint": "79a69c657f02dad35976cdc1182c80402d8997d5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8008",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1006d1bdff116cddf205533c34fd3e51",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8008,
        "service": "http-alt-8008",
        "service_name": "http-alt-8008",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,\f@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\f\ufffdV\ufffd\u000f\u000b\ufffd\ufffd\ufffd\ufffdNl*\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,\f@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\f\ufffdV\ufffd\u000f\u000b\ufffd\ufffd\ufffd\ufffdNl*\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u43cd\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdl\ufffd\u0005\ufffd\ufffd:$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd1\ufffdG\ufffd\u000b",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,\f@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\f\ufffdV\ufffd\u000f\u000b\ufffd\ufffd\ufffd\ufffdNl*\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4d7860dfe090313c253912a73d82e0fd6357616",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,\f@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\f\ufffdV\ufffd\u000f\u000b\ufffd\ufffd\ufffd\ufffdNl*\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8008,
        "service": "http-alt-8008",
        "service_label_fr": "HTTP ALT 8008"
    },
    "evidence_snippet": "\ufffd\ufffdo\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdNl*\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8008:8008 \u00b7 (sonde \/ probe)",
    "target_port_label": "8008 \u00b7 HTTP ALT 8008",
    "emulator_service": "http-alt-8008",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 57 % \u2014 via HTTP ALT 8008 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http-alt-8008",
        "service_label_fr": "HTTP ALT 8008",
        "dst_port": 8008,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8008",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,\f@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\f\ufffdV\ufffd\u000f\u000b\ufffd\ufffd\ufffd\ufffdNl*\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8008,
            "service": "http-alt-8008",
            "service_label_fr": "HTTP ALT 8008"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8008:8008 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdo\ufffd\ufffd\"[:\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd(1<\ufffd\ufffd!\ufffd,@\ufffd\ufffdGg \ufffdN9\u05f1]\ufffd\ufffdEL\ufffd\u0206:\ufffdc\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdNl*\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "8008 \u00b7 HTTP ALT 8008",
        "emulator_service": "http-alt-8008",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8008",
        "service_banner": "honeypot-http-alt-8008",
        "service_os": "linux",
        "dst_port": "8008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8008"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 261,
    "payload_entropy": 5.885623949076989,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http-alt-8008",
    "app_proto": "http-alt-8008",
    "asn": 16509,
    "country": "US",
    "dst_port": 8008,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "44b3f35faafd3524969073747a88a84f8d636a96",
    "event_fingerprint": "79a69c657f02dad35976cdc1182c80402d8997d5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8008",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fc05b6b220661cca70af8e37824c3109",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 8008,
        "service": "http-alt-8008",
        "service_name": "http-alt-8008",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u00105\ufffd%\ufffd\ufffd\ufffd\u000bH\ufffd\ufffd\ufffd\ufffd+y{\u001dT\ufffd\u001c\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffd\bG\ufffdP\ufffd\u0013\ufffd\u0015\u0002\b\\L\ufffdK\u0013m`\u001e~\ufffd\ufffd\u000b\ufffd\/\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u00105\ufffd%\ufffd\ufffd\ufffd\u000bH\ufffd\ufffd\ufffd\ufffd+y{\u001dT\ufffd\u001c\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffd\bG\ufffdP\ufffd\u0013\ufffd\u0015\u0002\b\\L\ufffdK\u0013m`\u001e~\ufffd\ufffd\u000b\ufffd\/\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffda\ufffd`B\ufffd\ufffd\ufffd\ufffd&\ufffd>\ufffd\ufffd\b\ufffd\u0004\u001b\ufffdq\u04b4\u001e\ufffd\ufffd\ufffd!",
        "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u00105\ufffd%\ufffd\ufffd\ufffd\u000bH\ufffd\ufffd\ufffd\ufffd+y{\u001dT\ufffd\u001c\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffd\bG\ufffdP\ufffd\u0013\ufffd\u0015\u0002\b\\L\ufffdK\u0013m`\u001e~\ufffd\ufffd\u000b\ufffd\/\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "782cc46d0cd5029ad95fafb49f122405abe9b6e6",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u00105\ufffd%\ufffd\ufffd\ufffd\u000bH\ufffd\ufffd\ufffd\ufffd+y{\u001dT\ufffd\u001c\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffd\bG\ufffdP\ufffd\u0013\ufffd\u0015\u0002\b\\L\ufffdK\u0013m`\u001e~\ufffd\ufffd\u000b\ufffd\/\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 8008,
        "service": "http-alt-8008",
        "service_label_fr": "HTTP ALT 8008"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd5\ufffd%\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+y{T\ufffd\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffdG\ufffdP\ufffd\ufffd\\L\ufffdKm`~\ufffd\ufffd\ufffd\/\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8008:8008 \u00b7 (sonde \/ probe)",
    "target_port_label": "8008 \u00b7 HTTP ALT 8008",
    "emulator_service": "http-alt-8008",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 57 % \u2014 via HTTP ALT 8008 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http-alt-8008",
        "service_label_fr": "HTTP ALT 8008",
        "dst_port": 8008,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8008",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u00105\ufffd%\ufffd\ufffd\ufffd\u000bH\ufffd\ufffd\ufffd\ufffd+y{\u001dT\ufffd\u001c\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffd\bG\ufffdP\ufffd\u0013\ufffd\u0015\u0002\b\\L\ufffdK\u0013m`\u001e~\ufffd\ufffd\u000b\ufffd\/\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 8008,
            "service": "http-alt-8008",
            "service_label_fr": "HTTP ALT 8008"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8008:8008 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd5\ufffd%\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+y{T\ufffd\ufffd\ufffd\ufffd~\ufffdZB9#\ufffd :pM\ufffdl\ufffdG\ufffdP\ufffd\ufffd\\L\ufffdKm`~\ufffd\ufffd\ufffd\/\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "8008 \u00b7 HTTP ALT 8008",
        "emulator_service": "http-alt-8008",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8008",
        "service_banner": "honeypot-http-alt-8008",
        "service_os": "linux",
        "dst_port": "8008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8008"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "2f04469f58c087671b6a6ba85c59ddf7574837ab",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.279724709743229,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 8008,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 51,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ef9987a617a2a6146a7604329b878d34cc3b3233",
    "event_fingerprint": "185d7bb07616422554e1f926743ef961b5eb7000",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 51
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "92f2e58f345de4dadfb933ae23e57ea2",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8008,
        "service": "http",
        "service_name": "http",
        "risk_score": 51
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed34d4023e9a3e94a675e6f4c16e05c19a4facff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 8008,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)",
    "target_port_label": "8008 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 51
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 51,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8008,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 8008,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "8008 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "2f04469f58c087671b6a6ba85c59ddf7574837ab",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.279724709743229,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 8008,
    "risk_waf": 72,
    "risk_classification": 72,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 51,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ef9987a617a2a6146a7604329b878d34cc3b3233",
    "event_fingerprint": "185d7bb07616422554e1f926743ef961b5eb7000",
    "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
    "confidence": 0.62,
    "classification_confidence": 0.62,
    "precision_score": 73,
    "precision_signals": [
        "MITRE-T1190"
    ],
    "kb_rule_ids": [
        "MITRE-T1190"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 72,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 51
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 62,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "92f2e58f345de4dadfb933ae23e57ea2",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8008,
        "service": "http",
        "service_name": "http",
        "risk_score": 51
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed34d4023e9a3e94a675e6f4c16e05c19a4facff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 8008,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "exploit attempt \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)",
    "target_port_label": "8008 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
        "confidence_pct": 62,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 72,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 51
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 51,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8008,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1190"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1190"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 8008,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "exploit attempt \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8008\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "8008 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain"
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.830507420471798,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 4500,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "54c513e34118c5890798d860cdf54a016f3a2b6c",
    "event_fingerprint": "21595702319834caa4857c648e6aa3751adc0a83",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536",
        "pat-0637"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ",
        "IKE NAT-T port"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536",
        "pat-0637"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "ea71d2ba7ddaa1fe1741e6c33f89492d",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 4500,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0011\ufffd\u0002\ufffd\u000b,5\ufffd\ufffd\u0000\ufffd\u00c3\ufffdZ\u0019\ufffd\r#(\ufffd\ufffdn\ufffd\u0010\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffd\u0001O\ufffd\ufffd4\ufffd\"\ufffd\u001d\\\ufffdD.\ufffd<\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0011\ufffd\u0002\ufffd\u000b,5\ufffd\ufffd\u0000\ufffd\u00c3\ufffdZ\u0019\ufffd\r#(\ufffd\ufffdn\ufffd\u0010\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffd\u0001O\ufffd\ufffd4\ufffd\"\ufffd\u001d\\\ufffdD.\ufffd<\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd-\u02a07\ufffd\ufffd5\u001dj\ufffd\u0016\ufffd\ufffd.\ufffd\u0015|\ufffd\ufffdc\ufffd\u0006\ufffd\u0012\ufffd\ufffd\ufffd4\ufffd~i",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0011\ufffd\u0002\ufffd\u000b,5\ufffd\ufffd\u0000\ufffd\u00c3\ufffdZ\u0019\ufffd\r#(\ufffd\ufffdn\ufffd\u0010\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffd\u0001O\ufffd\ufffd4\ufffd\"\ufffd\u001d\\\ufffdD.\ufffd<\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8de7659a78adcd86d1a76d55e7f00b32adb7aa4a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0011\ufffd\u0002\ufffd\u000b,5\ufffd\ufffd\u0000\ufffd\u00c3\ufffdZ\u0019\ufffd\r#(\ufffd\ufffdn\ufffd\u0010\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffd\u0001O\ufffd\ufffd4\ufffd\"\ufffd\u001d\\\ufffdD.\ufffd<\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 4500,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,5\ufffd\ufffd\ufffd\u00c3\ufffdZ\ufffd\r#(\ufffd\ufffdn\ufffd\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffdO\ufffd\ufffd4\ufffd\"\ufffd\\\ufffdD.\ufffd<&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:4500 \u00b7 (sonde \/ probe)",
    "target_port_label": "4500 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via TLS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 4500,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0011\ufffd\u0002\ufffd\u000b,5\ufffd\ufffd\u0000\ufffd\u00c3\ufffdZ\u0019\ufffd\r#(\ufffd\ufffdn\ufffd\u0010\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffd\u0001O\ufffd\ufffd4\ufffd\"\ufffd\u001d\\\ufffdD.\ufffd<\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 4500,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:4500 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,5\ufffd\ufffd\ufffd\u00c3\ufffdZ\ufffd\r#(\ufffd\ufffdn\ufffd\ufffd\ufffd\t \u027c\ufffd3\ufffdC\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdZ\ufffdM\ufffdO\ufffd\ufffd4\ufffd\"\ufffd\\\ufffdD.\ufffd<&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "4500 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "4500"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 261,
    "payload_entropy": 5.8259508885653375,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 16509,
    "country": "US",
    "dst_port": 4500,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "54c513e34118c5890798d860cdf54a016f3a2b6c",
    "event_fingerprint": "533bbd2b6c2d8190f0a79146b0f150e081db457b",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536",
        "pat-0637"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ",
        "IKE NAT-T port"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536",
        "pat-0637"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "payload_hash": "caa4757f41f1dd5f5dd7e1656797047f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 4500,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\u001a\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\u0000\ufffd\u0019\u001f\ufffdd4\ufffdt\ufffd\u0018:\ufffdM$Z\ufffd\u0016 \ufffdBQ\ufffd\n\u0017\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffd\u0007JL\/\u0012\ufffd\ufffdd\\d\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\u001a\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\u0000\ufffd\u0019\u001f\ufffdd4\ufffdt\ufffd\u0018:\ufffdM$Z\ufffd\u0016 \ufffdBQ\ufffd\n\u0017\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffd\u0007JL\/\u0012\ufffd\ufffdd\\d\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdG-\u001a\ufffdu\ufffd\ufffd'\ufffd\ufffdt\ufffdl\ufffdI\ufffdg\ufffd\ufffd0\u0000\ufffdv\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\u001a\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\u0000\ufffd\u0019\u001f\ufffdd4\ufffdt\ufffd\u0018:\ufffdM$Z\ufffd\u0016 \ufffdBQ\ufffd\n\u0017\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffd\u0007JL\/\u0012\ufffd\ufffdd\\d\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2e8e879cae9cf9c4a970fffb2df27c4cc79cd0fd",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\u001a\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\u0000\ufffd\u0019\u001f\ufffdd4\ufffdt\ufffd\u0018:\ufffdM$Z\ufffd\u0016 \ufffdBQ\ufffd\n\u0017\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffd\u0007JL\/\u0012\ufffd\ufffdd\\d\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "port": 4500,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdK\ufffd\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\ufffd\ufffdd4\ufffdt\ufffd:\ufffdM$Z\ufffd \ufffdBQ\ufffd\n\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffdJL\/\ufffd\ufffdd\\d&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:4500 \u00b7 (sonde \/ probe)",
    "target_port_label": "4500 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 57 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 4500,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\u001a\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\u0000\ufffd\u0019\u001f\ufffdd4\ufffdt\ufffd\u0018:\ufffdM$Z\ufffd\u0016 \ufffdBQ\ufffd\n\u0017\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffd\u0007JL\/\u0012\ufffd\ufffdd\\d\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
            "port": 4500,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:4500 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdK\ufffd\ufffd8\ufffdD+\ufffdU\ufffd\ufffd<\ufffd\ufffdd4\ufffdt\ufffd:\ufffdM$Z\ufffd \ufffdBQ\ufffd\n\ufffd\ufffd\ufffd\ufffdY\n\ufffd\ufffd5\ufffd\ufffdp<\ufffd\ufffdJL\/\ufffd\ufffdd\\d&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "4500 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8"
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "4500"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
    "http_host_hash": "624251ca10fd49fd6c8c0ca4b707265b64633d2c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.2712972727042935,
    "port_category": "registered",
    "org": "Amazon.com, Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 16509,
    "country": "US",
    "dst_port": 4500,
    "risk_waf": 72,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 43,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6ca3381de7af48b05105fbfdc40ed38c81f7c56d",
    "event_fingerprint": "e20298a458848dc5b05d194de3f1c8d2c86d177f",
    "classification_reason": "Type \u00ab ipsec_probe \u00bb (signaux protocolaires) \u00b7 confiance 37%",
    "confidence": 0.37,
    "classification_confidence": 0.37,
    "precision_score": 44,
    "precision_signals": [
        "pat-0637"
    ],
    "kb_rule_ids": [
        "pat-0637"
    ],
    "matched_patterns": [
        "pat-0637"
    ],
    "matched_pattern_names": [
        "IKE NAT-T port"
    ],
    "pattern_ids": [
        "pat-0637"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 43
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 37,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
        "payload_hash": "f1cbe65cda0c7418703a7e1aed17eba1",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 4500,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "method": "GET",
    "path": "\/",
    "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "classification_reason": "Type \u00ab ipsec_probe \u00bb (signaux protocolaires) \u00b7 confiance 37%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3549ab11966f512b446c8966320ddcf34c5afb9f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
        "port": 4500,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
    "attack_vector": "ipsec probe \u00b7 via HTTP:4500 \u00b7 (sonde \/ probe)",
    "target_port_label": "4500 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 37 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ipsec_probe \u00bb (signaux protocolaires) \u00b7 confiance 37%",
        "classification_reason_label_fr": "Type \u00ab ipsec_probe \u00bb (signaux protocolaires) \u00b7 confiance 37%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 37 % \u2014 via HTTP",
        "confidence_pct": 37,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 43
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4500,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0637"
        ],
        "tags_summary_labels_fr": [
            "pat-0637"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
            "port": 4500,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "ipsec probe \u00b7 via HTTP:4500 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4500\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
        "target_port_label": "4500 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 37 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 37 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF"
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4500"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "asn_dc_heuristic": true
}